From a367b6e10372b46fa10debd889e89aa65ca65aee Mon Sep 17 00:00:00 2001 From: Yosry Ahmed Date: Wed, 18 Feb 2026 15:09:53 -0800 Subject: [PATCH] KVM: nSVM: WARN and abort vmcb02 intercepts recalc if vmcb02 isn't active WARN and bail early from nested_vmcb02_recalc_intercepts() if vmcb02 isn't the active/current VMCB, as recalculating intercepts for vmcb01 using logic intended for merging vmcb12 and vmcb01 intercepts can yield unexpected and unwanted results. In addition to hardening against general bugs, this will provide additional safeguards "if" nested_vmcb02_recalc_intercepts() is invoked directly from nested_vmcb02_prepare_control(). Signed-off-by: Yosry Ahmed [sean: split to separate patch, bail early on "failure"] Link: https://patch.msgid.link/20260218230958.2877682-4-seanjc@google.com Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/nested.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 21ee75d6cdffa..75e7deef51a52 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -128,6 +128,9 @@ void nested_vmcb02_recalc_intercepts(struct vcpu_svm *svm) struct vmcb_ctrl_area_cached *g; unsigned int i; + if (WARN_ON_ONCE(svm->vmcb != svm->nested.vmcb02.ptr)) + return; + vmcb_mark_dirty(svm->vmcb, VMCB_INTERCEPTS); c = &svm->vmcb->control; -- 2.47.3