KVM: x86: Reject reserved CR8 bits in KVM_SET_SREGS

kvm_is_valid_sregs() validates the incoming CR0, CR4, and efer values but
never checks CR8.

When userspace passes a CR8 value with any of the reserved bits [63:4] set,
__set_sregs_common() forwards it to kvm_set_cr8(), which rejects the
reserved bits and returns early.  That return value is not checked, so the
ioctl reports success while the requested value is silently dropped.  A
subsequent KVM_GET_SREGS then returns a CR8 different from the one
userspace believed it had written.

Factor the reserved-bit check out into kvm_is_valid_cr8() and use it both
in kvm_set_cr8() and in kvm_is_valid_sregs().

Note, prior to commit 7017fc3d1a12 ("KVM: Define and use cr8 access
functions"), which unintentionally introduced the silent dropping behavior,
KVM didn't check the incoming CR8 at all, i.e. allowed illegal values and
likely generated failed VM-Entries.

Fixes: 6aa8b732ca01 ("[PATCH] kvm: userspace interface")
Fixes: 7017fc3d1a12 ("KVM: Define and use cr8 access functions")
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Link: https://patch.msgid.link/20260908160426.6547-2-tharitt97@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions