Re: [PATCH] KVM: nSVM: Check full nested state size before writing to user buffer

[Sean Christopherson <seanjc@google.com>]

On Thu, Nov 12, 2026, sashiko-bot@kernel.org wrote:
> [Severity: High]
> This problem wasn't introduced by this patch, but in the paired setter
> svm_set_nested_state() [1], does a failed nested_svm_load_cr3()
> leave the vCPU in guest mode with an active nested MMU context?
> 
> arch/x86/kvm/svm/nested.c:svm_set_nested_state() {
>     ...
> 	nested_vmcb02_prepare_control(svm);
>     ...
> 	ret = nested_svm_load_cr3(&svm->vcpu, vcpu->arch.cr3,
> 				  nested_npt_enabled(svm), false);
> 	if (ret)
> 		goto out_free;
>     ...
> }
> 
> nested_vmcb02_prepare_control() enters guest mode and initializes the
> nested MMU context, but the out_free error path only frees save and ctl
> without calling leave_guest_mode() or nested_svm_uninit_mmu_context().
> If userspace passes an invalid guest CR3 and then continues running the
> vCPU after KVM_SET_NESTED_STATE fails, the vCPU runs with a corrupted
> nested state and leaked MMU state.

Ya, I have this locally, just need to write a changelog and get it posted:

diff --git arch/x86/kvm/svm/nested.c arch/x86/kvm/svm/nested.c
index 07554089ec05..4b1cdc7798bb 100644
--- arch/x86/kvm/svm/nested.c
+++ arch/x86/kvm/svm/nested.c
@@ -2114,8 +2114,10 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
         */
        ret = nested_svm_load_cr3(&svm->vcpu, vcpu->arch.cr3,
                                  nested_npt_enabled(svm), false);
-       if (ret)
+       if (ret) {
+               svm_leave_nested(vcpu);
                goto out_free;
+       }
 
        svm->nested.force_msr_bitmap_recalc = true;