Re: [PATCH v7 13/20] KVM: x86: Reject EVEX-prefixed instructions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The EVEX prefix check reads `ctxt->modrm` without fetching it, resulting in the use of a stale value from a previously emulated instruction.
--

commit 01b255a08e34ec61090bf09c90c37d94d681cde4
Author: Chang S. Bae <chang.seok.bae@intel.com>

KVM: x86: Reject EVEX-prefixed instructions

Explicitly mark EVEX-prefixed opcodes (0x62) as unsupported.

> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index eba4e9b7cd5cf..f0d5a40eba27f 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -5052,6 +5052,11 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len, int
>  	if (opcode.flags & ModRM)
>  		ctxt->modrm = insn_fetch(u8, ctxt);
>  
> +	/* EVEX-prefixed instructions are not implemented */
> +	if (ctxt->opcode_len == 1 && ctxt->b == 0x62 &&
> +	    (mode == X86EMUL_MODE_PROT64 || (ctxt->modrm & 0xc0) == 0xc0))
> +		opcode.flags = NotImpl;
> +

[Severity: Medium]
Does this EVEX prefix check read a stale ctxt->modrm value?

In x86_decode_insn(), opcode 0x62 is mapped to NotImpl in the 1-byte opcode
table, which lacks the ModRM flag. This means ctxt->modrm is not fetched
by the check right above this new block.

As a result, if a guest executes opcode 0x62 in 16-bit or 32-bit mode, this
condition evaluates (ctxt->modrm & 0xc0) == 0xc0 using a leftover value from
a previously emulated instruction.

It was previously suggested this might trigger KMSAN warnings and cause a
host denial of service. Since ctxt is allocated via kmem_cache_zalloc(),
KMSAN sees the memory as initialized, which makes the DoS concern inaccurate.

However, does this logic flaw still break the intended EVEX detection? Since
0x62 already evaluates to NotImpl during the opcode table lookup, it seems
the subsequent opcode.flags = NotImpl assignment here is a no-op with no
functional impact.

>  done_modrm:
>  	ctxt->d = opcode.flags;
>  	while (ctxt->d & GroupMask) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902021804.718676-1-chang.seok.bae@intel.com?part=13