Root Cause Analysis

1. Functions, Structs, and Files Involved

• virt/kvm/kvm_main.c: kvm_vcpu_pre_fault_memory() handles the generic KVM_PRE_FAULT_MEMORY vCPU ioctl.
• arch/x86/kvm/mmu/mmu.c:
  • kvm_arch_vcpu_pre_fault_memory(): x86 architecture backend for prefaulting GPA ranges.
  • kvm_tdp_page_prefault(): Performs TDP prefaulting for a given GPA and checks vCPU requests.
• include/linux/kvm_host.h & arch/x86/kvm/smm.c (and other caller sites): kvm_vm_dead() marks a VM as dead and raises KVM_REQ_VM_DEAD on all vCPUs.

2. Mechanism and Trigger

1. When a fatal condition occurs in a VM that does not bug the host kernel data structures—for example, failure to enter SMM via enter_smm() in arch/x86/kvm/smm.c:370 (goto error -> kvm_vm_dead(vcpu->kvm)), or after context migration in sev_vm_move_enc_context_from()—KVM marks the VM dead by calling kvm_vm_dead(kvm).
2. kvm_vm_dead() sets kvm->vm_dead = true and raises KVM_REQ_VM_DEAD on each vCPU via kvm_make_all_cpus_request(kvm, KVM_REQ_VM_DEAD).
3. If userspace subsequently invokes ioctl(vcpu_fd, KVM_PRE_FAULT_MEMORY, ...) on the vCPU:
   • kvm_vcpu_ioctl() calls kvm_vcpu_pre_fault_memory().
   • kvm_vcpu_pre_fault_memory() invokes the arch hook kvm_arch_vcpu_pre_fault_memory(), which calls kvm_tdp_page_prefault().
   • In kvm_tdp_page_prefault() (arch/x86/kvm/mmu/mmu.c:5119):

     if (kvm_test_request(KVM_REQ_VM_DEAD, vcpu))
         return -EIO;
     

     kvm_tdp_page_prefault() checks for KVM_REQ_VM_DEAD to avoid getting stuck in a prefault retry loop and explicitly returns -EIO.
   • This -EIO is propagated back to kvm_vcpu_pre_fault_memory() in virt/kvm/kvm_main.c:4464-4465:

     r = kvm_arch_vcpu_pre_fault_memory(vcpu, range);
     if (WARN_ON_ONCE(r == 0 || r == -EIO))
         break;
     

   • Because r == -EIO (-5, matching register R12 = 0xfffffffffffffffb), WARN_ON_ONCE(r == 0 || r == -EIO) triggers.

The defect is an API contract mismatch between the generic KVM pre-fault memory loop in virt/kvm/kvm_main.c (which assumes -EIO is a bug that should never occur and asserts on it) and the architecture-specific TDP page fault handler (which legitimately returns -EIO when KVM_REQ_VM_DEAD is set).

3. Runtime Consequences in a Production Kernel

• Memory Corruption: False. No invalid memory access, out-of-bounds write/read, or use-after-free occurs.
• Info Leak: "none". No kernel memory or pointer values are disclosed to userspace.
• Denial of Service: False. WARN_ON_ONCE does not halt execution in a production kernel without panic_on_warn. When the warning fires, execution immediately executes break;, drops the SRCU lock (srcu_read_unlock(&vcpu->kvm->srcu, idx)), releases the vCPU (vcpu_put(vcpu)), and safely returns -EIO to userspace. All kernel state remains consistent and no deadlock or leak ensues.