Re: [PATCH v3 11/17] KVM: arm64: Filter out non-kernel addresses in kern_hyp_va

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Short-circuiting `kern_hyp_va()` for addresses below `PAGE_OFFSET` allows a malicious untrusted host to bypass EL2 address translation and access hypervisor-private memory.
--

--- Patch [11]: [PATCH v3 11/17] KVM: arm64: Filter out non-kernel addresses in kern_hyp_va ---
commit 9a2b59e70629aff87b63154ca5dea88e30d5381e
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Filter out non-kernel addresses in kern_hyp_va

This commit attempts to make kern_hyp_va() idempotent for non-TTBR1
addresses by short-circuiting the mask-and-tag operation if the address
is below PAGE_OFFSET. The intention is to handle hypervisor linear space
pointers correctly without mangling hypervisor private range addresses.

> diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
> --- a/arch/arm64/include/asm/kvm_mmu.h
> +++ b/arch/arm64/include/asm/kvm_mmu.h
> @@ -126,6 +126,9 @@ static __always_inline unsigned long __kern_hyp_va(unsigned long v)
>   * replace the instructions with `nop`s.
>   */
>  #ifndef __KVM_VHE_HYPERVISOR__
> +	if (!is_ttbr1_addr(v))
> +		return v;
> +
[Severity: Critical]
Does this short-circuit allow an untrusted host to bypass address translation
and access hypervisor-private memory?

In a pKVM environment, if the host issues a hypercall in the always-on band
and passes a forged pointer corresponding to an EL2 private virtual address,
is_ttbr1_addr() will evaluate to false because the forged address is below
PAGE_OFFSET.

As a result, kern_hyp_va() returns the forged address unmodified, completely
bypassing the mask-and-tag translation. Could this allow the host to trick
the hypervisor into reading or writing EL2 private structures by directly
dereferencing the returned pointer?

>  	asm volatile(ALTERNATIVE_CB("and %0, %0, #1\n"         /* mask with va_mask */
>  				    "ror %0, %0, #1\n"         /* rotate to the first tag bit */
>  				    "add %0, %0, #0\n"         /* insert the low 12 bits of the tag */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720171513.1415357-1-vdonnefort@google.com?part=11