[PATCH v2] KVM: nSVM: Check full nested state size before writing to user buffer

[PATCH v2] KVM: nSVM: Check full nested state size before writing to user buffer

[Priyanka Mani]

svm_get_nested_state() compares the userspace-provided buffer size against
kvm_state.size before adding KVM_STATE_NESTED_SVM_VMCB_SIZE for a vCPU that
is in guest mode.  When L2 is active and userspace passes a size that is
large enough for the header but too small for the vmcb12 payload, KVM thus
skips the early exit, copies out the header, clears and fills the full 4KiB
vmcb12 area past the end of the buffer described by userspace, and only
then does the caller notice that the returned size is larger than the
provided one and fail with -E2BIG.

As a result, KVM writes up to 4KiB beyond the buffer userspace said it
has, and if that memory isn't mapped, the ioctl fails with -EFAULT instead
of the documented -E2BIG without reporting the required size.

Move the size check to immediately before the first copy_to_user(), after
the header, including kvm_state.size, has been fully filled in, so that a
too-small buffer is rejected without writing anything to it, and so that
any future additions to the size are automatically covered by the check.

Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
Cc: stable@vger.kernel.org
Suggested-by: Dan Carpenter <dan@pereq.eu>
Signed-off-by: Priyanka Mani <priyankamani2100@gmail.com>
---

Notes:
    v2:
     - Move the user_data_size check to right before the first copy_to_user()
       instead of computing the size up front, so that future additions to
       kvm_state.size are covered automatically. [Dan, Sean]
     - Add Suggested-by: Dan Carpenter.
    
    v1: https://lore.kernel.org/all/57324d544da1e92cf3b30ff7c40595dfbca1933d.1794465097.git.priyankamani2100@gmail.com
    
    Tested on an AMD EPYC 7763 host by booting the patched kernel under QEMU
    (nested SVM) with KASAN and lockdep.  A reproducer enters L2, exits to
    userspace from L2 and calls KVM_GET_NESTED_STATE with
    size = sizeof(struct kvm_nested_state).  Without this patch, KVM writes
    4096 bytes past the 128-byte buffer before returning -E2BIG, or returns
    -EFAULT if the next page is unmapped.  With this patch, KVM returns
    -E2BIG and reports size = 4224 without writing to the buffer.
    
    KVM selftests nested_set_state_test, state_test, smm_test, hyperv_svm_test,
    svm_nested_vmcb12_gpa, svm_nested_pat_test and the other nested SVM tests
    give identical results with and without the patch.

 arch/x86/kvm/svm/nested.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 1cecb82702e2..229b8dff5506 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1916,9 +1916,6 @@ static int svm_get_nested_state(struct kvm_vcpu *vcpu,
 
 	svm = to_svm(vcpu);
 
-	if (user_data_size < kvm_state.size)
-		goto out;
-
 	/* First fill in the header and copy it out.  */
 	if (is_guest_mode(vcpu)) {
 		kvm_state.hdr.svm.vmcb_pa = svm->nested.vmcb12_gpa;
@@ -1935,6 +1932,9 @@ static int svm_get_nested_state(struct kvm_vcpu *vcpu,
 	if (gif_set(svm))
 		kvm_state.flags |= KVM_STATE_NESTED_GIF_SET;
 
+	if (user_data_size < kvm_state.size)
+		goto out;
+
 	if (copy_to_user(user_kvm_nested_state, &kvm_state, sizeof(kvm_state)))
 		return -EFAULT;
 

base-commit: cbe54fc3462b3949ab27b9ae81fb9ddb509040c7
-- 
2.43.0

Re: [PATCH v2] KVM: nSVM: Check full nested state size before writing to user buffer

[Dan Carpenter]

On Fri, Nov 13, 2026 at 05:01:14AM +0000, Priyanka Mani wrote:
> svm_get_nested_state() compares the userspace-provided buffer size against
> kvm_state.size before adding KVM_STATE_NESTED_SVM_VMCB_SIZE for a vCPU that
> is in guest mode.  When L2 is active and userspace passes a size that is
> large enough for the header but too small for the vmcb12 payload, KVM thus
> skips the early exit, copies out the header, clears and fills the full 4KiB
> vmcb12 area past the end of the buffer described by userspace, and only
> then does the caller notice that the returned size is larger than the
> provided one and fail with -E2BIG.
> 
> As a result, KVM writes up to 4KiB beyond the buffer userspace said it
> has, and if that memory isn't mapped, the ioctl fails with -EFAULT instead
> of the documented -E2BIG without reporting the required size.
> 
> Move the size check to immediately before the first copy_to_user(), after
> the header, including kvm_state.size, has been fully filled in, so that a
> too-small buffer is rejected without writing anything to it, and so that
> any future additions to the size are automatically covered by the check.
> 
> Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
> Cc: stable@vger.kernel.org
> Suggested-by: Dan Carpenter <dan@pereq.eu>

Really suggested-by is only meant for original suggestions, not review
feedback.  But I'm always willing to accept undeserved credit.

Reviewed-by: Dan Carpenter <dan@pereq.eu>

regards,
dan carpenter