Re: [PATCH v5 12/12] KVM: SVM: Add support for virtualizating Bus Lock Detect

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: x86: Host DoS via WARN_ON_ONCE in kvm_deliver_exception_payload()
--

commit ae1e356a2c3cc9178bead14afcfa89eabb330003
Author: Ravi Bangoria <ravi.bangoria@amd.com>

    KVM: SVM: Add support for virtualizating Bus Lock Detect
    
    Advertise support for virtualizing Bus Lock Detect and allow the guest to
    enable BUS_LOCK_DETECT if LBR Virtualization is enabled (Bus Lock Detect is
    enabled through MSR_IA32_DEBUGCTLMSR, which context-switched if and only if
    LBR Virtualization is enabled).

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 1e58ad8691e92..e7c296c52591f 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
[ ... ]
> @@ -5712,9 +5712,17 @@ static __init void svm_set_cpu_caps(void)
>  	 * Clear capabilities that are automatically configured by common code,
>  	 * but that require explicit SVM support (that isn't yet implemented).
>  	 */
> -	kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT);
>  	kvm_cpu_cap_clear(X86_FEATURE_MSR_IMM);
>  
> +	/*
> +	 * LBR Virtualization must be enabled to support BusLockTrap inside the
> +	 * guest, since BusLockTrap is enabled through MSR_IA32_DEBUGCTLMSR and
> +	 * MSR_IA32_DEBUGCTLMSR is virtualized only if LBR Virtualization is
> +	 * enabled.
> +	 */
> +	if (!lbrv)
> +		kvm_cpu_cap_clear(X86_FEATURE_BUS_LOCK_DETECT);

[Severity: High]
Could exposing X86_FEATURE_BUS_LOCK_DETECT introduce a regression where a
malicious unprivileged userspace process can cause a host denial of service
via WARN_ON_ONCE?

A malicious unprivileged userspace process can call KVM_SET_VCPU_EVENTS
with an exception payload that has bit 11 (DR6_BUS_LOCK) or bit 16
(DR6_RTM) set. This unsanitized payload is accepted and passed into the
vcpu architecture state:

arch/x86/kvm/x86.c:kvm_vcpu_ioctl_x86_set_vcpu_events()
	vcpu->arch.exception.payload = events->exception_payload;

When KVM_RUN injects the exception, it calls kvm_deliver_exception_payload().
Because these bits are within DR6_ACTIVE_LOW, the payload application
clears them from vcpu->arch.dr6.

However, if the guest CPU lacks support for these features, dr6_fixed_1
will have these bits set to 1. The subsequent sanity check evaluates to
true because the bits were just cleared, reliably triggering the WARN_ON_ONCE:

arch/x86/kvm/x86.c:kvm_deliver_exception_payload()
		if (WARN_ON_ONCE((vcpu->arch.dr6 & dr6_fixed_1) != dr6_fixed_1))
			vcpu->arch.dr6 |= dr6_fixed_1;

Any unprivileged process with access to /dev/kvm can trigger this, which
may panic the host if panic_on_warn is set.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930011313.3197688-1-seanjc@google.com?part=12