github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64

Browse Source 
The nr_pages field in struct kvm_tdx_init_mem_region is a u64 that comes
directly from userspace via copy_from_user().  The current validation
uses a manual overflow check:

  region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa

When nr_pages >= 2^52, the shift (nr_pages << PAGE_SHIFT) wraps around
to a small value, bypassing the wrap check.  While downstream protections
(gfn_to_memslot() returning NULL for GFNs outside any memslot, and
kvm_slot_has_gmem() checking for NULL) prevent any actual out-of-bounds
access, the overflow itself is a real bug that should be caught at the
validation layer.

Replace the manual overflow check with check_shl_overflow() to correctly
detect the wrap-around.

Note, the manual wrap-around check on the gpa+size technically has a benign
off-by-one bug, and can also use check_add_overflow().  Those flaws will be
addressed shortly.

Opportunistically separate the initial sanity checks from the more involved
checks to try and make the code easier to read.

Fixes: c846b451d3 ("KVM: TDX: Add an ioctl to create initial guest memory")
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260630214952.98C851F000E9@smtp.kernel.org
Cc: Yan Zhao <yan.y.zhao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
[sean: use gpa_t, isolate check_shl_overflow() change, tweak changelog]
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260806170602.4112602-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Haotian Jiang 2026-08-06 10:06:01 -07:00 committed by Sean Christopherson
parent 1a66112cbc
commit aec196ba2a
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
arch/x86/kvm/vmx/tdx.c
View File

@ -3257,6 +3257,7 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
struct kvm_tdx_init_mem_region region;
struct tdx_gmem_post_populate_arg arg;
gpa_t nr_bytes;
long gmem_ret;
int ret;
@ -3274,10 +3275,13 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
return -EFAULT;
if (!PAGE_ALIGNED(region.source_addr) || !region.source_addr ||
!PAGE_ALIGNED(region.gpa) || !region.nr_pages ||
region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa ||
!PAGE_ALIGNED(region.gpa) || !region.nr_pages)
return -EINVAL;
if (check_shl_overflow(region.nr_pages, PAGE_SHIFT, &nr_bytes) ||
region.gpa + nr_bytes <= region.gpa ||
!vt_is_tdx_private_gpa(kvm, region.gpa) ||
!vt_is_tdx_private_gpa(kvm, region.gpa + (region.nr_pages << PAGE_SHIFT) - 1))
!vt_is_tdx_private_gpa(kvm, region.gpa + nr_bytes - 1))
return -EINVAL;
ret = 0;