linux-kernel - Re: [PATCH 04/28] KVM: SVM: Kill the VM instead of the host if MSR interception is buggy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aD6tFSu5dvEQs8dJ@intel.com>
Date: Tue, 3 Jun 2025 16:06:45 +0800
From: Chao Gao <chao.gao@...el.com>
To: Sean Christopherson <seanjc@...gle.com>
CC: Paolo Bonzini <pbonzini@...hat.com>, <kvm@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, Borislav Petkov <bp@...en8.de>, Xin Li
	<xin@...or.com>, Dapeng Mi <dapeng1.mi@...ux.intel.com>
Subject: Re: [PATCH 04/28] KVM: SVM: Kill the VM instead of the host if MSR
 interception is buggy

On Thu, May 29, 2025 at 04:39:49PM -0700, Sean Christopherson wrote:
>WARN and kill the VM instead of panicking the host if KVM attempts to set
>or query MSR interception for an unsupported MSR.  Accessing the MSR
>interception bitmaps only meaningfully affects post-VMRUN behavior, and
>KVM_BUG_ON() is guaranteed to prevent the current vCPU from doing VMRUN,
>i.e. there is no need to panic the entire host.
>
>Signed-off-by: Sean Christopherson <seanjc@...gle.com>
>---
> arch/x86/kvm/svm/svm.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
>index 36a99b87a47f..d5d11cb0c987 100644
>--- a/arch/x86/kvm/svm/svm.c
>+++ b/arch/x86/kvm/svm/svm.c
>@@ -827,7 +827,8 @@ static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
> 	bit_write = 2 * (msr & 0x0f) + 1;
> 	tmp       = msrpm[offset];

not an issue with this patch. but shouldn't the offset be checked against
MSR_INVALID before being used to index msrpm[]?

> 
>-	BUG_ON(offset == MSR_INVALID);
>+	if (KVM_BUG_ON(offset == MSR_INVALID, vcpu->kvm))
>+		return false;
> 
> 	return test_bit(bit_write, &tmp);
> }
>@@ -858,7 +859,8 @@ static void set_msr_interception_bitmap(struct kvm_vcpu *vcpu, u32 *msrpm,
> 	bit_write = 2 * (msr & 0x0f) + 1;
> 	tmp       = msrpm[offset];
> 
>-	BUG_ON(offset == MSR_INVALID);
>+	if (KVM_BUG_ON(offset == MSR_INVALID, vcpu->kvm))
>+		return;
> 
> 	read  ? clear_bit(bit_read,  &tmp) : set_bit(bit_read,  &tmp);
> 	write ? clear_bit(bit_write, &tmp) : set_bit(bit_write, &tmp);
>-- 
>2.49.0.1204.g71687c7c1d-goog
>