linux-kernel - Re: [PATCH v3 2/8] KVM: x86: nSVM: Cache and validate vmcb12 g

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fb750b1bb21bd47f85eb133d69b2c059188f4c05@linux.dev>
Date: Fri, 06 Feb 2026 18:23:35 +0000
From: "Yosry Ahmed" <yosry.ahmed@...ux.dev>
To: "Sean Christopherson" <seanjc@...gle.com>, "Jim Mattson"
 <jmattson@...gle.com>
Cc: "Paolo Bonzini" <pbonzini@...hat.com>, "Thomas Gleixner"
 <tglx@...nel.org>, "Ingo Molnar" <mingo@...hat.com>, "Borislav Petkov"
 <bp@...en8.de>, "Dave Hansen" <dave.hansen@...ux.intel.com>,
 x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, "Shuah Khan"
 <shuah@...nel.org>, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-kselftest@...r.kernel.org
Subject: Re: [PATCH v3 2/8] KVM: x86: nSVM: Cache and validate vmcb12 g_pat

February 6, 2026 at 10:19 AM, "Sean Christopherson" <seanjc@...gle.com> wrote:

> 
> On Thu, Feb 05, 2026, Jim Mattson wrote:
> 
> > 
> > Cache g_pat from vmcb12 in svm->nested.gpat to avoid TOCTTOU issues, and
> >  add a validity check so that when nested paging is enabled for vmcb12, an
> >  invalid g_pat causes an immediate VMEXIT with exit code VMEXIT_INVALID, as
> >  specified in the APM, volume 2: "Nested Paging and VMRUN/VMEXIT."
> >  
> >  Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
> >  Signed-off-by: Jim Mattson <jmattson@...gle.com>
> >  ---
> >  arch/x86/kvm/svm/nested.c | 4 +++-
> >  arch/x86/kvm/svm/svm.h | 3 +++
> >  2 files changed, 6 insertions(+), 1 deletion(-)
> >  
> >  diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> >  index f72dbd10dcad..1d4ff6408b34 100644
> >  --- a/arch/x86/kvm/svm/nested.c
> >  +++ b/arch/x86/kvm/svm/nested.c
> >  @@ -1027,9 +1027,11 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu)
> >  
> >  nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
> >  nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
> >  + svm->nested.gpat = vmcb12->save.g_pat;
> >  
> >  if (!nested_vmcb_check_save(vcpu) ||
> >  - !nested_vmcb_check_controls(vcpu)) {
> >  + !nested_vmcb_check_controls(vcpu) ||
> >  + (nested_npt_enabled(svm) && !kvm_pat_valid(svm->nested.gpat))) {
> >  vmcb12->control.exit_code = SVM_EXIT_ERR;
> >  vmcb12->control.exit_info_1 = 0;
> >  vmcb12->control.exit_info_2 = 0;
> >  diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> >  index 986d90f2d4ca..42a4bf83b3aa 100644
> >  --- a/arch/x86/kvm/svm/svm.h
> >  +++ b/arch/x86/kvm/svm/svm.h
> >  @@ -208,6 +208,9 @@ struct svm_nested_state {
> >  */
> >  struct vmcb_save_area_cached save;
> >  
> >  + /* Cached guest PAT from vmcb12.save.g_pat */
> >  + u64 gpat;
> > 
> Shouldn't this go in vmcb_save_area_cached?

I believe Jim changed it after this discussion on v2: https://lore.kernel.org/kvm/20260115232154.3021475-4-jmattson@google.com/.