Re: [PATCH v10 02/28] KVM: VMX: Initialize VM entry/exit FRED controls in vmcs_config

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] `vmx_check_entry_exit_pairs` incorrectly validates multi-bit exit controls, silently accepting partial feature enablement and exposing the host to privilege escalation.
--

commit 2bf701245fc6586c07b00b47292677b65ee2dec9
Author: Xin Li (Intel) <xin@zytor.com>

KVM: VMX: Initialize VM entry/exit FRED controls in vmcs_config

This commit sets up VM entry and exit FRED controls in the global
vmcs_config to ensure guest FRED state is saved and loaded correctly.
It also adds a check to the existing consistency framework.

[ ... ]

> diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
> index b4aec4218b7da..062631e2dd376 100644
> --- a/arch/x86/kvm/vmx/vmx.c
> +++ b/arch/x86/kvm/vmx/vmx.c
> @@ -2778,6 +2778,8 @@ static int setup_vmcs_config(struct vmcs_config *vmcs_conf,
>  		u32 entry_control;
>  		u64 exit_control;
>  	} const vmcs_entry_exit2_pairs[] = {
> +		{ VM_ENTRY_LOAD_IA32_FRED,
> +			SECONDARY_VM_EXIT_SAVE_IA32_FRED | SECONDARY_VM_EXIT_LOAD_IA32_FRED },

[Severity: Critical]
Can this multi-bit mask bypass the validation logic in
vmx_check_entry_exit_pairs?

Looking at how vmx_check_entry_exit_pairs validates these fields:

#define vmx_check_entry_exit_pairs(pairs, entry_controls, exit_controls) \
...
	if (!(entry_controls & n_ctrl) == !(exit_controls & x_ctrl))     \
		continue;

If the hardware or an L0 hypervisor provides only one of the two FRED exit
bits, a bitwise AND against the multi-bit x_ctrl mask will still be non-zero.

This makes !(exit_controls & x_ctrl) evaluate to 0, which matches the entry
side, bypassing the inconsistency check entirely.

Could this allow KVM to be partially configured without returning -EIO?

If only one of the exit controls is enabled, could the host resume execution
after a VM-exit with guest-controlled FRED MSRs?

Would this result in a privilege escalation by allowing the next host
interrupt to execute arbitrary guest-controlled code in host context?

>  	};
>  
>  	memset(vmcs_conf, 0, sizeof(*vmcs_conf));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911213659.2025974-1-sohil.mehta@intel.com?part=2