Re: [PATCH v2 15/28] KVM: Take memory protections into account for memory read/write/fetch

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: vcpu_map bypasses KVM_MEMORY_ATTRIBUTE_NR/NW protections
--

commit 79f1cf1f5a4245adbef80d2c22573dcd13309746
Author: Nicolas Saenz Julienne <nsaenz@amazon.com>

KVM: Take memory protections into account for memory read/write/fetch

Take into account memory attributes when accessing guest memory through
the kvm_{read,write,fetch}*() family of functions.

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index c910beb7a3aa5..e3ea9ceed01ea 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c

[ ... ]

> @@ -3395,6 +3409,10 @@ static int __kvm_write_guest_page(struct kvm *kvm,
>  	addr = gfn_to_hva_memslot(memslot, gfn);
>  	if (kvm_is_error_hva(addr))
>  		return -EFAULT;
> +
> +	if (!kvm_mem_attributes_may_write_gfn(kvm, gfn))
> +		return -EFAULT;
> +
>  	r = __copy_to_user((void __user *)addr + offset, data, len);
>  	if (r)
>  		return -EFAULT;

[Severity: High]
While this patch updates the read/write/fetch helpers, does it inadvertently
leave __kvm_vcpu_map() vulnerable to bypassing memory protections?

In virt/kvm/kvm_main.c:__kvm_vcpu_map(), KVM resolves and maps the PFN into
kernel space without checking KVM_MEMORY_ATTRIBUTE_NR/NW memory attributes:

int __kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
                   bool writable)
{
        ...
        map->pfn = kvm_follow_pfn(&kfp);
        if (is_error_noslot_pfn(map->pfn))
                return -EINVAL;

        if (pfn_valid(map->pfn)) {
                map->page = pfn_to_page(map->pfn);
                map->hva = kmap(map->page);
        ...
}

If a malicious L1 guest provides a protected GPA (marked Non-Writable or
Non-Readable by host userspace via KVM_SET_MEMORY_ATTRIBUTES) to an interface
mapped via kvm_vcpu_map (such as a nested VMCS, VMCB, or APIC access page),
KVM will successfully read/write it outside the guest MMU. Can we check
kvm_get_memory_attributes() here before mapping to prevent KVM from acting
as a confused deputy and violating the host's memory protections?

While pfncache and cached offset accessors were explicitly fixed in follow-up
patches within this series (e.g., 'KVM: pfncache: Fail to refresh if it
contains memory protections' and 'KVM: Take memory protections into account
for accesses with cached gfn->hva'), __kvm_vcpu_map was missed.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918081543.139871-1-pbonzini@redhat.com?part=15