Re: [PATCH] KVM: nSVM: Check full nested state size before writing to user buffer

[Sean Christopherson <seanjc@google.com>]

On Thu, Nov 12, 2026, Dan Carpenter wrote:
> On Thu, Nov 12, 2026 at 06:41:43AM +0000, Priyanka Mani wrote:
> > svm_get_nested_state() compares the userspace-provided buffer size against
> > kvm_state.size before adding KVM_STATE_NESTED_SVM_VMCB_SIZE for a vCPU that
> > is in guest mode.  When L2 is active and userspace passes a size that is
> > large enough for the header but too small for the vmcb12 payload, KVM thus
> > skips the early exit, copies out the header, clears and fills the full 4KiB
> > vmcb12 area past the end of the buffer described by userspace, and only
> > then does the caller notice that the returned size is larger than the
> > provided one and fail with -E2BIG.
> > 
> > As a result, KVM writes up to 4KiB beyond the buffer userspace said it
> > has, and if that memory isn't mapped, the ioctl fails with -EFAULT instead
> > of the documented -E2BIG without reporting the required size.
> > 
> > Compute the full size before the check, as vmx_get_nested_state() does, so
> > that a too-small buffer is rejected without writing anything to it.
> 
> I would prefer to instead move the if (user_data_size < kvm_state.size)
> check until right before the copy_to_user().  It's more future proof
> that way.

+1

Side topic, your mail got flagged by gmail with:

  This message isn't authenticated and the sender can't be verified.