Re: [PATCH 03/24] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Guest-reachable `pr_err` calls without ratelimiting in `setup_vmgexit_scratch` allow a malicious SEV-ES guest to flood the host kernel log.
--

commit e862165e67c650ff667c57363d24f101d03cf5e9
Author: Sean Christopherson <seanjc@google.com>

KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+

This commit updates KVM to reject MMIO requests larger than 8 bytes when
using GHCB version 2 or later, as required by the GHCB specification.

> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -4502,6 +4502,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
>  		if (!len)
>  			return 1;
>  
> +		if (to_kvm_sev_info(vcpu->kvm)->ghcb_version >= 2 && len > 8) {
> +			svm_vmgexit_bad_input(svm, GHCB_ERR_INVALID_INPUT);
> +			return 1;
> +		}
> +
>  		ret = setup_vmgexit_scratch(svm, !is_write, len);

[Severity: High]
This isn't a bug introduced by this patch, but looking at
setup_vmgexit_scratch() called here:

arch/x86/kvm/svm/sev.c:setup_vmgexit_scratch() {
	scratch_gpa_beg = svm->sev_es.sw_scratch;
	if (!scratch_gpa_beg) {
		pr_err("vmgexit: scratch gpa not provided\n");
		goto e_scratch;
	}
...

Could a malicious SEV-ES guest flood the host kernel log by repeatedly
triggering this error path?

If the guest continuously passes invalid scratch parameters, the function
immediately returns 1 and resumes the guest without exiting to userspace.
Does this allow an infinite loop of un-ratelimited pr_err() calls that
could stall the host CPU and cause console lockups?

>  		if (ret)
>  			break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529183549.1104619-1-pbonzini@redhat.com?part=3