Re: [PATCH] KVM: nSVM: Check full nested state size before writing to user buffer

[Dan Carpenter <dan@pereq.eu>]

On Thu, Nov 12, 2026 at 06:41:43AM +0000, Priyanka Mani wrote:
> svm_get_nested_state() compares the userspace-provided buffer size against
> kvm_state.size before adding KVM_STATE_NESTED_SVM_VMCB_SIZE for a vCPU that
> is in guest mode.  When L2 is active and userspace passes a size that is
> large enough for the header but too small for the vmcb12 payload, KVM thus
> skips the early exit, copies out the header, clears and fills the full 4KiB
> vmcb12 area past the end of the buffer described by userspace, and only
> then does the caller notice that the returned size is larger than the
> provided one and fail with -E2BIG.
> 
> As a result, KVM writes up to 4KiB beyond the buffer userspace said it
> has, and if that memory isn't mapped, the ioctl fails with -EFAULT instead
> of the documented -E2BIG without reporting the required size.
> 
> Compute the full size before the check, as vmx_get_nested_state() does, so
> that a too-small buffer is rejected without writing anything to it.

I would prefer to instead move the if (user_data_size < kvm_state.size)
check until right before the copy_to_user().  It's more future proof
that way.

regards,
dan carpenter