KVM: TDX: Avoid a double-KVM_BUG_ON() in tdx_sept_zap_private_spte()

Return -EIO immediately from tdx_sept_zap_private_spte() if the number of
to-be-added pages underflows, so that the following "KVM_BUG_ON(err, kvm)"
isn't also triggered.  Isolating the check from the "is premap error"
if-statement will also allow adding a lockdep assertion that premap errors
are encountered if and only if slots_lock is held.

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20251030200951.3402865-14-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 1315fd9fdd6e9dbec96b9383b683097ea052973d..4426146d403e331ee86287971814e9a89d399d95 100644 (file)
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1725,8 +1725,10 @@ static int tdx_sept_zap_private_spte(struct kvm *kvm, gfn_t gfn,
                err = tdh_mem_range_block(&kvm_tdx->td, gpa, tdx_level, &entry, &level_state);
                tdx_no_vcpus_enter_stop(kvm);
        }
-       if (tdx_is_sept_zap_err_due_to_premap(kvm_tdx, err, entry, level) &&
-           !KVM_BUG_ON(!atomic64_read(&kvm_tdx->nr_premapped), kvm)) {
+       if (tdx_is_sept_zap_err_due_to_premap(kvm_tdx, err, entry, level)) {
+               if (KVM_BUG_ON(!atomic64_read(&kvm_tdx->nr_premapped), kvm))
+                       return -EIO;
+
                atomic64_dec(&kvm_tdx->nr_premapped);
                return 0;
        }