Re: [PATCH 05/11] KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: svm: invalid pointer dereference in msr_write_intercepted due to SME/SEV C-bit
--

commit 043abbaa7ab3cef236605eca71fa3da8b7711f0e
Author: Sean Christopherson <seanjc@google.com>

KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted

This commit modifies KVM to use the MSR permission bitmap of the active VMCB
instead of maintaining separate tracking logic. It dynamically calculates the
virtual address of the bitmap from the physical address stored in the VMCB
control area using __va().

Message-ID: <20260826195833.844526-1-seanjc@google.com>

> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index f4f488328ea42..1f279cd91ecfb 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -673,16 +673,7 @@ static void clr_dr_intercepts(struct vcpu_svm *svm)
>  
>  static bool msr_write_intercepted(struct vcpu_svm *svm, u32 msr)
>  {
[ ... ]
> -	void *msrpm = is_guest_mode(&svm->vcpu) ? svm->nested.msrpm : svm->msrpm;
> +	void *msrpm = __va(svm->vmcb->control.msrpm_base_pa);

[Severity: Critical]
Does this introduce an invalid pointer dereference when SME or SEV is active?

When Secure Memory Encryption (SME) or Secure Encrypted Virtualization (SEV)
is enabled, physical addresses programmed into hardware structures must
include the encryption bit (C-bit). KVM enforces this by setting the bit
when populating svm->vmcb->control.msrpm_base_pa.

Since __va() on x86 directly adds PAGE_OFFSET to the physical address
without masking out the encryption C-bit, passing the raw physical address
here appears to create an out-of-bounds virtual address. When
svm_test_msr_bitmap_write() immediately dereferences this address, won't
it cause a host panic via a kernel page fault (#PF or #GP)?

Because msr_write_intercepted() is called during VM execution paths, could
a local user with /dev/kvm privileges trigger this to cause a denial of
service on SME/SEV-enabled hardware?

(Note: This issue appears to remain unfixed in the final state of the patch
series at commit 497a001eb419947b).

>  
>  	return svm_test_msr_bitmap_write(msrpm, msr);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926053253.195597-1-pbonzini@redhat.com?part=5