Re: [PATCH 5.15.y] KVM: nSVM: Check validity of vmcs01 save area copied from SMRAM on RSM

[Sean Christopherson <seanjc@google.com>]

On Wed, Nov 11, 2026, Sasha Levin wrote:
> From: Sean Christopherson <seanjc@google.com>
> 
> [ Upstream commit 053621535f014085c935879582dd3b65964a0dce ]
> 
> When doing RSM to L2, validate L1's state after copying it back into vmcb01
> from SMRAM, as SMRAM is carved out of guest memory, i.e. is writable by the
> guest.  Failure to validate L1's state is especially problematic for inputs
> to MMU context, as KVM can end up with impossible CR4 vs. EFER state.  E.g.
> without the recent hardening FNAME(walk_addr_generic), a guest can trigger:
> 
>   ------------[ cut here ]------------
>   UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu/paging_tmpl.h:435:15
>   index 3 is out of range for type 'u32 [2]'
>   CPU: 3 UID: 0 PID: 92 Comm: CPU 1/KVM Not tainted 7.3.0-rc1 #2 PREEMPT(lazy)
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
>   Call Trace:
>    <TASK>
>    dump_stack_lvl+0x5f/0x90
>    dump_stack+0x10/0x18
>    ubsan_epilogue+0x9/0x39
>    __ubsan_handle_out_of_bounds.cold+0x50/0x55
>    paging32_walk_addr_generic+0x889/0x970
>    paging32_page_fault+0x79/0xa60
>    kvm_mmu_do_page_fault+0x125/0x270
>    kvm_mmu_page_fault+0x88/0x7b0
>    npf_interception+0xc8/0x220 [kvm_amd]
>    svm_invoke_exit_handler+0x16d/0x1d0 [kvm_amd]
>    svm_handle_exit+0xb7/0x160 [kvm_amd]
>    vcpu_enter_guest+0x428/0x16a0
>    kvm_arch_vcpu_ioctl_run+0x479/0x920
>    kvm_vcpu_ioctl+0x316/0xb00
>    __x64_sys_ioctl+0xa3/0x100
>    x64_sys_call+0x281/0x23d0
>    do_syscall_64+0xba/0x550
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   RIP: 0033:0x79bb30deb04b
>    </TASK>
>   ---[ end trace ]---
> 
> Fixes: 37be407b2ce8 ("KVM: nSVM: Fix L1 state corruption upon return from SMM")
> Cc: stable@vger.kernel.org
> Reported-by: Bill Wendling <morbo@google.com>
> Reported-by: Stefan Teodorescu <fane@google.com>
> Tested-by: Stefan Teodorescu <fane@google.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20261022021046.295001-1-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> [ sashal: reused nested_vmcb_valid_sregs() with an is_l1 argument instead of
> adding the upstream cached-save validation helper ] 

Woof, that's ugly.  But I don't see a better option, so,

Acked-by: Sean Christopherson <seanjc@google.com>