Re: [PATCH v2] KVM: nSVM: Check full nested state size before writing to user buffer

[Dan Carpenter <dan@pereq.eu>]

On Fri, Nov 13, 2026 at 05:01:14AM +0000, Priyanka Mani wrote:
> svm_get_nested_state() compares the userspace-provided buffer size against
> kvm_state.size before adding KVM_STATE_NESTED_SVM_VMCB_SIZE for a vCPU that
> is in guest mode.  When L2 is active and userspace passes a size that is
> large enough for the header but too small for the vmcb12 payload, KVM thus
> skips the early exit, copies out the header, clears and fills the full 4KiB
> vmcb12 area past the end of the buffer described by userspace, and only
> then does the caller notice that the returned size is larger than the
> provided one and fail with -E2BIG.
> 
> As a result, KVM writes up to 4KiB beyond the buffer userspace said it
> has, and if that memory isn't mapped, the ioctl fails with -EFAULT instead
> of the documented -E2BIG without reporting the required size.
> 
> Move the size check to immediately before the first copy_to_user(), after
> the header, including kvm_state.size, has been fully filled in, so that a
> too-small buffer is rejected without writing anything to it, and so that
> any future additions to the size are automatically covered by the check.
> 
> Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
> Cc: stable@vger.kernel.org
> Suggested-by: Dan Carpenter <dan@pereq.eu>

Really suggested-by is only meant for original suggestions, not review
feedback.  But I'm always willing to accept undeserved credit.

Reviewed-by: Dan Carpenter <dan@pereq.eu>

regards,
dan carpenter