[PATCH] KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

[PATCH] KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

[Fuad Tabba]

pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided
sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()
and the WARN_ON() there, which is fatal at EL2. The existing
!sve_state_size test rejects such a length, but only after the macro has
run.

Check sve_vl_valid() before deriving the state size. A valid length
cannot yield a zero size, so the !sve_state_size test goes with it.

Fixes: 5db1bef93342 ("KVM: arm64: Track SVE state in the hypervisor vcpu structure")
Reported-by: Stefan Teodorescu <fane@google.com>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---

Notes:
    Based on v7.2. Applies cleanly to kvmarm/next as well:
    pkvm_vcpu_init_sve() is identical on both.

 arch/arm64/kvm/hyp/nvhe/pkvm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index 24d6f164129ac..095ebfce91b08 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -460,14 +460,15 @@ static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *h
 
 	/* Limit guest vector length to the maximum supported by the host. */
 	sve_max_vl = min(READ_ONCE(host_vcpu->arch.sve_max_vl), kvm_host_sve_max_vl);
-	sve_state_size = sve_state_size_from_vl(sve_max_vl);
 	sve_state = kern_hyp_va(READ_ONCE(host_vcpu->arch.sve_state));
 
-	if (!sve_state || !sve_state_size) {
+	if (!sve_vl_valid(sve_max_vl) || !sve_state) {
 		ret = -EINVAL;
 		goto err;
 	}
 
+	sve_state_size = sve_state_size_from_vl(sve_max_vl);
+
 	ret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size);
 	if (ret)
 		goto err;
-- 
2.39.5

Re: [PATCH] KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

[Marc Zyngier]

On Tue, 18 Aug 2026 10:31:17 +0100,
Fuad Tabba <fuad.tabba@linux.dev> wrote:
> 
> pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided
> sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()
> and the WARN_ON() there, which is fatal at EL2. The existing
> !sve_state_size test rejects such a length, but only after the macro has
> run.
> 
> Check sve_vl_valid() before deriving the state size. A valid length
> cannot yield a zero size, so the !sve_state_size test goes with it.
> 
> Fixes: 5db1bef93342 ("KVM: arm64: Track SVE state in the hypervisor vcpu structure")
> Reported-by: Stefan Teodorescu <fane@google.com>
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>

Reviewed-by: Marc Zyngier <maz@kernel.org>

	M.

-- 
Without deviation from the norm, progress is not possible.