Re: [PATCH 3/4] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Modifying a const-qualified structure field via a pointer cast invokes Undefined Behavior, allowing the compiler to optimize out the mitigation and leaving KVM vulnerable to processing corrupted MMU states.
--

commit 398614ee03891692ae2eecdde307edc043d7403e
Author: Sean Christopherson <seanjc@google.com>

KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

This commit attempts to mitigate invalid MMU roles by bugging the VM and
clearing EFER.LMA if long mode is active without PAE paging enabled.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 064ecc33b9267..81c30e2c74f3c 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -5910,6 +5910,9 @@ static union kvm_cpu_role kvm_calc_cpu_role(struct kvm_vcpu *vcpu,
>  		return role;
>  	}
>  
> +	if (KVM_BUG_ON(____is_efer_lma(regs) && !____is_cr4_pae(regs), vcpu->kvm))
> +		*(u64 *)&regs->efer &= ~EFER_LMA;

[Severity: High]
Does casting away the const qualifier and modifying regs->efer here invoke
undefined behavior?

The regs pointer points to a struct kvm_mmu_role_regs, which defines the
efer field as const:

struct kvm_mmu_role_regs {
	const unsigned long cr0;
	const unsigned long cr4;
	const u64 efer;
};

Modifying a const-qualified object invokes undefined behavior per C11 6.7.3p6.
Because the regs structure is typically allocated locally on the stack, for
example via vcpu_to_role_regs, and passed to kvm_calc_cpu_role, modern
compilers have full visibility into the object's definition and can cache the
initial const value of regs.efer in a register.

If the compiler evaluates subsequent checks like ____is_efer_lma(regs) using
this cached value, could this completely bypass the sanitization? 

If an untrusted guest attempts to set its vCPU state with EFER.LMA=1 but
CR4.PAE=0, this bypass could cause KVM to compute a corrupted MMU role, such
as configuring 64-bit levels but 32-bit PTE sizes, which then escapes into
the MMU configuration.

While KVM_BUG_ON flags the VM as bugged, the function continues executing
with the corrupted role, potentially leading to out-of-bounds accesses before
the VM is fully halted.

This issue defeats the purpose of the security mitigation and is not fixed by
the subsequent commit "KVM: x86/mmu: Convert MMU walker's bounds check from
BUG_ON() to KVM_BUG_ON()".

> +
>  	role.base.efer_nx = ____is_efer_nx(regs);
>  	role.base.cr0_wp = ____is_cr0_wp(regs);
>  	role.base.cr4_smep = ____is_cr4_smep(regs);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826211844.884951-1-seanjc@google.com?part=3