From: Binbin Wu <binbin.wu@linux.intel.com>
To: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Sashiko Bot <sashiko-bot@kernel.org>,
Yan Zhao <yan.y.zhao@intel.com>,
Ackerley Tng <ackerleytng@google.com>,
Haotian Jiang <jianghaotian.sunday@gmail.com>
Subject: Re: [PATCH v2 2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION
Date: Mon, 10 Aug 2026 17:23:56 +0800 [thread overview]
Message-ID: <14193ad6-8046-44cb-99f5-d357e1b03d2d@linux.intel.com> (raw)
In-Reply-To: <20260806170602.4112602-3-seanjc@google.com>
On 8/7/2026 1:06 AM, Sean Christopherson wrote:
> When verifying that the incoming GPA rage for INIT_MEM_REGION doesn't wrap,
> check the inclusive last GPA, not the exclusive last GPA. Super duper
> technically, it's ok if the very last GPA is -1ull. In practice, the flaw
> is benign as KVM x86 disallows memslots with GPAs that exceed MAXPHYADDR,
> i.e. INIT_MEM_REGION would fail with -EINVAL anyways due to the memslot
> check in kvm_gmem_populate().
>
> Opportunistically use check_add_overflow() instead of manually checking for
> wrap, mostly so that the inclusive math doesn't need to be copy+pasted in
> the "is private" check.
>
> Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
> Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
prev parent reply other threads:[~2026-08-10 9:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-06 17:06 [PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes Sean Christopherson
2026-08-06 17:06 ` [PATCH v2 1/2] KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64 Sean Christopherson
2026-08-10 6:27 ` Yan Zhao
2026-08-10 8:45 ` Binbin Wu
2026-08-06 17:06 ` [PATCH v2 2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION Sean Christopherson
2026-08-10 6:58 ` Yan Zhao
2026-08-10 9:23 ` Binbin Wu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=14193ad6-8046-44cb-99f5-d357e1b03d2d@linux.intel.com \
--to=binbin.wu@linux.intel.com \
--cc=ackerleytng@google.com \
--cc=jianghaotian.sunday@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=sashiko-bot@kernel.org \
--cc=seanjc@google.com \
--cc=yan.y.zhao@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.