Re: [PATCH v3 2/5] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] KVM_SET_SREGS bypasses EFER validation, permitting userspace to set unsupported EFER bits and potentially triggering a host kernel BUG_ON.
--

--- Patch [2]: [PATCH v3 2/5] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported ---
commit 804513f9cd9e8710ae3f651192ce52e48ee9e59a
Author: Yosry Ahmed <yosry@kernel.org>

KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported

Remove EFER.LME and EFER.LMA from EFER reserved bits only if long mode
is actually supported.

> KVM does check long-mode support before allowing
> the bits for guest writes and userspace writes through KVM_SET_SREGS*
> (in __kvm_valid_efer()), but userspace writes through KVM_SET_MSRS only
> check reserved bits.

[Severity: High]
This isn't a bug introduced by this patch, but is the claim about
KVM_SET_SREGS* checking __kvm_valid_efer() accurate?

It looks like KVM_SET_SREGS can actually bypass __kvm_valid_efer(). If
userspace invokes the KVM_SET_SREGS ioctl with a crafted sregs structure
where EFER_LME=1, EFER_LMA=1, CR0.PG=1, and CR4.PAE=1, this state appears
to bypass the consistency checks in kvm_is_valid_sregs().

Then, __set_sregs_common() applies the EFER bits directly via the
architecture-specific callback:

arch/x86/kvm/regs.c:__set_sregs_common() {
    ...
    kvm_x86_call(set_efer)(vcpu, sregs->efer);
    ...
}

On a 32-bit KVM host (!CONFIG_X86_64), this call reaches vmx_set_efer(),
which unconditionally triggers a KVM_BUG_ON since long mode is not
supported:

arch/x86/kvm/vmx/vmx.c:vmx_set_efer() {
    ...
    if (KVM_BUG_ON(efer & EFER_LMA, vcpu->kvm))
        return 1;
    ...
}

Additionally, on SVM, bypassing __kvm_valid_efer() allows userspace to set
EFER_SVME and force nested state allocation even when the guest lacks the
X86_FEATURE_SVM capability.

Could this allow a malicious unprivileged userspace process to trigger a
host kernel panic (if panic_on_warn=1) by forcing this KVM_BUG_ON?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713181020.2735367-1-yosry@kernel.org?part=2