Re: [PATCH] KVM: arm64: Reject the stage-2 MMU pointer hypercalls under pKVM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Hypercall handlers `handle___kvm_adjust_pc`, `handle___vgic_v5_save_apr`, and `handle___vgic_v5_restore_vmcr_apr` dereference host-provided pointers via `kern_hyp_va()` without validation, allowing a malicious host to corrupt EL2-private memory under pKVM.
--

commit 6af3790e411879ef8c99b26ae2afdc619730e489
Author: Fuad Tabba <fuad.tabba@linux.dev>

KVM: arm64: Reject the stage-2 MMU pointer hypercalls under pKVM

This patch updates five stage-2 MMU pointer hypercalls to reject execution when
pKVM is enabled. It adds an is_protected_kvm_enabled() check to prevent
invalid execution paths.

Link: https://lore.kernel.org/all/20260914130152.F0D5F1F000FF@smtp.kernel.org/

> diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> index 9a3b92e626adb..4b0d00e55e2ea 100644
> --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c

[ ... ]

arch/arm64/kvm/hyp/nvhe/hyp-main.c:handle___kvm_adjust_pc() {
	DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1);

	__kvm_adjust_pc(kern_hyp_va(vcpu));
}

[Severity: Critical]
This is a pre-existing issue, but does this code allow a malicious host to
corrupt EL2-private memory?

The unvalidated host pointer vcpu is passed directly to __kvm_adjust_pc
which mutates it. An untrusted host could invoke the
__KVM_HOST_SMCCC_FUNC___kvm_adjust_pc hypercall with a crafted pointer (e.g.,
an EL2 private-memory pointer which is idempotent under kern_hyp_va()). The
handler handle___kvm_adjust_pc directly passes this unvalidated pointer to the
underlying function, which dereferences it. This could allow the host to
overwrite arbitrary EL2 memory or leak its contents into system registers.

arch/arm64/kvm/hyp/nvhe/hyp-main.c:handle___vgic_v5_save_apr() {
	DECLARE_REG(struct vgic_v5_cpu_if *, cpu_if, host_ctxt, 1);

	__vgic_v5_save_apr(kern_hyp_va(cpu_if));
}

arch/arm64/kvm/hyp/nvhe/hyp-main.c:handle___vgic_v5_restore_vmcr_apr() {
	DECLARE_REG(struct vgic_v5_cpu_if *, cpu_if, host_ctxt, 1);

	__vgic_v5_restore_vmcr_apr(kern_hyp_va(cpu_if));
}

[Severity: Critical]
This is a pre-existing issue, but can these handlers corrupt EL2 memory under
pKVM?

Similar to the above, the unvalidated host pointer cpu_if is dereferenced and
written to by __vgic_v5_save_apr and __vgic_v5_restore_vmcr_apr. An
untrusted host could invoke the corresponding hypercalls with a crafted pointer,
allowing a malicious host to corrupt EL2-private memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914174521.832575-1-fuad.tabba@linux.dev?part=1