KVM: selftests: Fix the bounds of the SEV debug dst buffer check

validate_dst() is passed a starting offset and a byte count, but bounds
its loop with "i < nr_bytes", comparing the offset against the count
rather than against offset + nr_bytes.  Only calls that pass offset 0
check the region they were asked to check.  Every other call checks too
few bytes, and any call whose offset is >= the count returns without
checking anything at all.

Of the 1990 validate_dst() calls a full run makes per VM type, 740 (37%)
check zero bytes, only the 29 zero-offset calls are correct, and 62% of
the intended bytes are checked overall.  The unaligned offsets the sweep
deliberately picks to exercise partial chunks are precisely the ones
that end up checking nothing.

The bug is latent today: validate_buffers() runs first and compares all
of src[] against dst[], so a genuine {en,de}crypt corruption is still
caught.  That is presumably why this went unnoticed.

Bound the loop with offset + nr_bytes, and rename the parameter to
offset so it cannot be mistaken for a length again.  The caller already
guarantees offset + nr_bytes <= BUFFER_SIZE, so the corrected loop stays
in bounds.

Fixes: 6edd35e77a42 ("KVM: selftests: Add a test to verify SEV {en,de}crypt debug ioctls")
Signed-off-by: Gokul K <gokul02k@gmail.com>
Link: https://patch.msgid.link/20260808061934.400892-1-gokul02k@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions