Re: [PATCH v2 4/5] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Modifying a const-qualified struct member via pointer cast invokes undefined behavior, and the compiler may optimize away subsequent checks, defeating the bug mitigation.
--

commit a1c4dd28227e88b096d9ee6618a2543aab000da4
Author: Sean Christopherson <seanjc@google.com>

KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0

This commit adds a KVM_BUG_ON check to catch invalid CPU roles where long
mode is active but PAE paging is not. It attempts to mitigate the fallout by
clearing the EFER_LMA bit in the provided registers before continuing MMU
construction.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 064ecc33b9267..81c30e2c74f3c 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -5910,6 +5910,9 @@ static union kvm_cpu_role kvm_calc_cpu_role(struct kvm_vcpu *vcpu,
>  		return role;
>  	}
>  
> +	if (KVM_BUG_ON(____is_efer_lma(regs) && !____is_cr4_pae(regs), vcpu->kvm))
> +		*(u64 *)&regs->efer &= ~EFER_LMA;

[Severity: High]
Does modifying a const-qualified struct member via a pointer cast invoke
undefined behavior here?

Looking at the definition of struct kvm_mmu_role_regs:

struct kvm_mmu_role_regs {
	const unsigned long cr0;
	const unsigned long cr4;
	const u64 efer;
};

Since the efer member is explicitly declared as const, could the compiler
assume it never changes after initialization and optimize away the clearing 
of EFER_LMA for the subsequent checks in kvm_calc_cpu_role()? 

If the compiler uses a cached value for the remaining efer checks, it seems
this would bypass the intended bug mitigation entirely and still construct a
completely invalid MMU role.

> +
>  	role.base.efer_nx = ____is_efer_nx(regs);
>  	role.base.cr0_wp = ____is_cr0_wp(regs);
>  	role.base.cr4_smep = ____is_cr4_smep(regs);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902232028.2767071-1-seanjc@google.com?part=4