Re: [PATCH v6 11/18] KVM: arm64: Filter out non-kernel addresses in kern_hyp_va

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] mm: EL2 memory corruption via kern_hyp_va bypass for non-TTBR1 addresses
--

commit 8768ff7b59b5b3eb8674eb929fc20e711a216dbf
Author: Vincent Donnefort <vdonnefort@google.com>

KVM: arm64: Filter out non-kernel addresses in kern_hyp_va

kern_hyp_va() is idempotent for the hypervisor linear space, which is handy
for nVHE hypervisor callers. This commit adds a check based on PAGE_OFFSET
to filter out non-kernel addresses, extending idempotence to the hypervisor
private range.

> diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
> index 57f65257bb56d..04d9f59db976f 100644
> --- a/arch/arm64/include/asm/kvm_mmu.h
> +++ b/arch/arm64/include/asm/kvm_mmu.h
> @@ -128,6 +128,9 @@ static __always_inline unsigned long __kern_hyp_va(unsigned long v)
>   * replace the instructions with nops.
>   */
>  #ifndef __KVM_VHE_HYPERVISOR__
> +	if (is_protected_kvm_enabled() && !is_ttbr1_addr(v))
> +		return v;
> +

[Severity: Critical]
Does this bypass address translation for untrusted host-provided pointers
when they are not TTBR1 addresses?

While this makes kern_hyp_va() idempotent for EL2 private addresses,
kern_hyp_va_host() also uses __kern_hyp_va() on unvalidated host arguments.

For example, if the host issues a hypercall like __vgic_v5_save_apr and
passes an EL2 private address:

arch/arm64/kvm/hyp/nvhe/hyp-main.c:handle___vgic_v5_save_apr() {
    ...
    __vgic_v5_save_apr(kern_hyp_va_host(cpu_if));
    ...
}

Because is_ttbr1_addr(v) is false, __kern_hyp_va() will return the EL2
private address unmodified. The handler then dereferences it:

arch/arm64/kvm/hyp/vgic-v5-sr.c:__vgic_v5_save_apr() {
    ...
    cpu_if->vgic_apr = read_sysreg_s(SYS_ICH_APR_EL2);
    ...
}

Could this regression allow an untrusted host (EL1) to execute an arbitrary
write into EL2 private memory and break the pKVM trust boundary?

>  	asm volatile(ALTERNATIVE_CB("and %0, %0, #1\n"         /* mask with va_mask */
>  				    "ror %0, %0, #1\n"         /* rotate to the first tag bit */
>  				    "add %0, %0, #0\n"         /* insert the low 12 bits of the tag */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001142849.3367614-1-vdonnefort@google.com?part=11