Re: [PATCH v5 06/12] KVM: x86: Kill off DR6_FIXED_1 to prevent future misuse

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] x86/kvm: Host-triggerable WARN_ON_ONCE in kvm_deliver_exception_payload()
--

commit 48eae248dd35f5828c9a4c63f37a8c7de96050db
Author: Sean Christopherson <seanjc@google.com>

KVM: x86: Kill off DR6_FIXED_1 to prevent future misuse

This commit drops the hardcoded DR6_FIXED_1 macro to force all references
to fixed-1 bits to use the vCPU-aware helper. It also rewords the comment
about DR6_ACTIVE_LOW to explain why treating fixed-1 bits as active-low is
correct. No functional change is intended.

> diff --git a/arch/x86/kvm/regs.c b/arch/x86/kvm/regs.c
> index db43ade8ceb10..0c76cf17e8847 100644
> --- a/arch/x86/kvm/regs.c
> +++ b/arch/x86/kvm/regs.c
> @@ -774,7 +774,7 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_update_dr7);
>  
>  unsigned long kvm_get_dr6_fixed_1(struct kvm_vcpu *vcpu)
>  {
> -	unsigned long fixed = DR6_FIXED_1;
> +	unsigned long fixed = DR6_ACTIVE_LOW & ~DR6_VOLATILE;
>  
>  	if (!guest_cpu_cap_has(vcpu, X86_FEATURE_RTM))
>  		fixed |= DR6_RTM;

[Severity: High]
Does this code allow an unvalidated exception payload to trigger a host
WARN_ON_ONCE?

Looking at kvm_vcpu_ioctl_x86_set_vcpu_events(), it accepts an unvalidated
exception payload from host userspace into the vcpu state:

arch/x86/kvm/x86.c:kvm_vcpu_ioctl_x86_set_vcpu_events()
    vcpu->arch.exception.payload = events->exception_payload;

When KVM later processes this exception in kvm_deliver_exception_payload(),
it computes dr6_fixed_1 using kvm_get_dr6_fixed_1() and then clears any
active-low bits present in the payload from vcpu->arch.dr6:

arch/x86/kvm/x86.c:kvm_deliver_exception_payload()
    vcpu->arch.dr6 &= ~(ex->payload & DR6_ACTIVE_LOW);

If a malicious payload sets active-low fixed-1 bits (like DR6_RTM when it is
unsupported by the guest), those bits are improperly cleared from the guest's
DR6 register.

This causes the subsequent check to fail and trigger the warning:

arch/x86/kvm/x86.c:kvm_deliver_exception_payload()
    if (WARN_ON_ONCE((vcpu->arch.dr6 & dr6_fixed_1) != dr6_fixed_1))
        vcpu->arch.dr6 |= dr6_fixed_1;

Since panic_on_warn could be enabled, could an unprivileged host userspace
process use this regression to trigger a host-side Denial of Service?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930011313.3197688-1-seanjc@google.com?part=6