Re: [PATCH v6 13/20] KVM: x86: Reject EVEX-prefixed instructions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added EVEX prefix check evaluates an uninitialized or stale `ctxt->modrm` byte in 32-bit mode and is entirely redundant because KVM already maps opcode 0x62 to `NotImpl`.
--

--- Patch [13]: [PATCH v6 13/20] KVM: x86: Reject EVEX-prefixed instructions ---
commit 086b81f7f3526e32d2a152bf460681542a47ce74
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Reject EVEX-prefixed instructions

This commit explicitly marks EVEX-prefixed opcodes (0x62) as unsupported
in the x86 instruction emulator.

> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index cb075bd74f769..fc7f9f17c1da4 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -5045,6 +5045,11 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len, int
>  	if (opcode.flags & ModRM)
>  		ctxt->modrm = insn_fetch(u8, ctxt);
>  
> +	/* EVEX-prefixed instructions are not implemented */
> +	if (ctxt->opcode_len == 1 && ctxt->b == 0x62 &&
> +	    (mode == X86EMUL_MODE_PROT64 || (ctxt->modrm & 0xc0) == 0xc0))

[Severity: Medium]
Could this evaluate an uninitialized or stale ctxt->modrm?

Looking at x86_decode_insn(), since opcode 0x62 is already mapped to
NotImpl in the KVM opcode_table, the opcode.flags & ModRM condition will
be false, and ctxt->modrm will not be fetched just above this check.

When evaluating this in 32-bit mode, would it end up reading an
uninitialized struct member, even though the instruction is already
set to be rejected anyway?

> +		opcode.flags = NotImpl;
> +
>  done_modrm:
>  	ctxt->d = opcode.flags;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729191656.598771-1-chang.seok.bae@intel.com?part=13