Re: [PATCH 1/7] KVM: SVM: Add VMCB fields for LBR v2 virtualization

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `svm_get_nested_state` function writes out-of-bounds to userspace memory if `user_data_size` is exactly `sizeof(struct kvm_nested_state)`.
--

--- Patch [1]: [PATCH 1/7] KVM: SVM: Add VMCB fields for LBR v2 virtualization ---
commit 91df21ca3dd4f3f8277b9ddd8eb84059e0bca6d1
Author: Sandipan Das <sandipan.das@amd.com>

KVM: SVM: Add VMCB fields for LBR v2 virtualization

Define the new VMCB fields that will be used to save and restore the
state of the Last Branch Record Extension Version 2 (LbrExtV2) related
MSRs.

> diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
> index aa63431ba92c3..fbcf6c4dbb92a 100644
> --- a/arch/x86/include/asm/svm.h
> +++ b/arch/x86/include/asm/svm.h
> @@ -552,7 +559,7 @@ struct vmcb {
>  	};
>  } __packed;
>  
> -#define EXPECTED_VMCB_SAVE_AREA_SIZE		744
> +#define EXPECTED_VMCB_SAVE_AREA_SIZE		1912
>  #define EXPECTED_GHCB_SAVE_AREA_SIZE		1032
>  #define EXPECTED_SEV_ES_SAVE_AREA_SIZE		1648

[ ... ]

[Severity: High]
This is a pre-existing issue, but can svm_get_nested_state() write
out-of-bounds to userspace memory if user_data_size is exactly
sizeof(struct kvm_nested_state)?

When user_data_size == kvm_state.size, this initial check evaluates to false:

arch/x86/kvm/svm/nested.c:svm_get_nested_state() {
    ...
	if (user_data_size < kvm_state.size)
		goto out;
    ...
}

The function then proceeds, expanding kvm_state.size, but never re-checks if
the user-provided buffer is large enough before clearing the memory:

arch/x86/kvm/svm/nested.c:svm_get_nested_state() {
    ...
	if (clear_user(user_vmcb, KVM_STATE_NESTED_SVM_VMCB_SIZE))
		return -EFAULT;
    ...
}

Can this corrupt the VMM's memory by writing 4096 bytes past the end of the
user's 120-byte allocation if a VMM dynamically probes the required size?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724195040.630468-1-shivansh.dhiman@amd.com?part=1