Re: [PATCH v21 02/15] KVM: arm64: Refuse to start a guest with S1PIE or S1POE but not TCR2

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: arm64: TOCTOU race bypasses S1PIE/TCR2 ID register validation
--

commit ecf3602b27fe0cb6f8ce76b1a8c6698e3dee08f4
Author: Mark Brown <broonie@kernel.org>

KVM: arm64: Refuse to start a guest with S1PIE or S1POE but not TCR2

This commit adds validation to reject starting a guest with FEAT_S1PIE or
FEAT_S1POE enabled if FEAT_TCR2 is disabled, as the hypervisor requires
TCR2 to properly context-switch these registers.

> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 44aae52c473d7..3ae293798b270 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c

[ ... ]

> @@ -5928,6 +5946,9 @@ int kvm_finalize_sys_regs(struct kvm_vcpu *vcpu)
>  		kvm_vgic_finalize_idregs(kvm);
>  	}
>  
> +	if (!kvm_validate_id_regs(vcpu->kvm))
> +		return -EINVAL;
> +

[Severity: Critical]
Does this introduce a Time-Of-Check to Time-Of-Use (TOCTOU) regression
that bypasses the S1PIE/TCR2 ID register check?

If Thread A executes the first KVM_RUN, it passes this kvm_validate_id_regs()
check because the invalid configuration hasn't been set yet. The config_lock
is then released.

Thread B could then execute KVM_SET_ONE_REG for the ID register, take
config_lock, and inject the invalid S1PIE=1/TCR2=0 configuration via
set_id_reg() in arch/arm64/kvm/sys_regs.c, bypassing the immutability check
because KVM_ARCH_FLAG_HAS_RAN_ONCE is not yet set.

When Thread A proceeds to execute kvm_calculate_traps(), it reads the
maliciously modified ID registers and disables the traps, before finally
setting KVM_ARCH_FLAG_HAS_RAN_ONCE in kvm_arch_vcpu_run_pid_change() in
arch/arm64/kvm/arm.c.

This regression allows KVM to configure traps based on S1PIE, disabling the
trap for PIRE0_EL1, but skipping context-switching the register because TCR2
is disabled. Could this allow the guest to directly overwrite the host's
physical PIRE0_EL1 register?

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930-arm64-gcs-v21-0-3556644cd927@kernel.org?part=2