From: Peter Fang <peter.fang@intel.com>
To: <sashiko-reviews@lists.linux.dev>
Cc: <kvm@vger.kernel.org>
Subject: Re: [PATCH v3 4/4] virt: tdx-guest: Allocate Quote buffer dynamically
Date: Thu, 3 Sep 2026 00:04:53 -0700 [thread overview]
Message-ID: <apkcFclEw1LNd96h@intel.com> (raw)
In-Reply-To: <20260729125524.48FD91F00AC4@smtp.kernel.org>
On Wed, Jul 29, 2026 at 12:55:23PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
>
> New issues:
> - [High] Untrusted VMM input `TDCS_QUOTE_MAX_SIZE` is passed directly to the page allocator without bounding and without `__GFP_NOWARN`, which can trigger a kernel warning (`WARN_ON_ONCE`) and panic the guest if `panic_on_warn` is set.
>
This was discussed in v2 [1][2]. __GFP_NOWARN doesn't make sense here.
[1] https://lore.kernel.org/all/741eb8b8b83dd10d39f304133a7625f4232ab793.camel@intel.com/
[2] https://lore.kernel.org/all/amCv00f5Q6QlztyY@thinkstation/
> Pre-existing issues:
> - [High] Pre-existing UAF/Use-After-Unload race condition if module initialization fails after registering the misc device.
> --
Sashiko reported this in v2 [3]. Added to my todo list.
[3] https://lore.kernel.org/all/20260727101350.GB482062@pedri/
>
next prev parent reply other threads:[~2026-09-03 7:05 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 12:29 [PATCH v3 0/4] tdx-guest: Make Quote buffer size dynamic Peter Fang
2026-07-29 12:29 ` [PATCH v3 1/4] x86/tdx: Add helper to query maximum TD Quote size Peter Fang
2026-09-03 6:04 ` Tony Lindgren
2026-09-03 22:45 ` Peter Fang
2026-07-29 12:29 ` [PATCH v3 2/4] virt: tdx-guest: Calculate the Quote buffer size safely Peter Fang
2026-07-29 18:29 ` Kuppuswamy Sathyanarayanan
2026-09-03 5:33 ` Xiaoyao Li
2026-09-03 6:05 ` Tony Lindgren
2026-09-03 9:18 ` Binbin Wu
2026-07-29 12:29 ` [PATCH v3 3/4] virt: tdx-guest: Use a variable to store the Quote buffer size Peter Fang
2026-07-29 12:58 ` sashiko-bot
2026-09-03 5:25 ` Peter Fang
2026-07-29 18:47 ` Kuppuswamy Sathyanarayanan
2026-09-02 23:15 ` Peter Fang
2026-09-03 5:59 ` Xiaoyao Li
2026-09-04 1:28 ` Peter Fang
2026-09-03 6:31 ` Tony Lindgren
2026-09-04 4:51 ` Peter Fang
2026-09-03 9:17 ` Binbin Wu
2026-09-04 6:49 ` Peter Fang
2026-07-29 12:29 ` [PATCH v3 4/4] virt: tdx-guest: Allocate Quote buffer dynamically Peter Fang
2026-07-29 12:55 ` sashiko-bot
2026-09-03 7:04 ` Peter Fang [this message]
2026-09-03 6:21 ` Xiaoyao Li
2026-09-03 6:33 ` Tony Lindgren
2026-07-29 21:21 ` [PATCH v3 0/4] tdx-guest: Make Quote buffer size dynamic Edgecombe, Rick P
2026-08-11 22:40 ` Edgecombe, Rick P
2026-08-12 14:08 ` Sean Christopherson
2026-08-12 16:02 ` Edgecombe, Rick P
2026-08-12 16:43 ` Sean Christopherson
2026-08-12 17:22 ` Edgecombe, Rick P
2026-08-12 22:37 ` Peter Fang
2026-08-12 22:47 ` Edgecombe, Rick P
2026-08-12 23:10 ` Sean Christopherson
2026-08-12 23:30 ` Edgecombe, Rick P
2026-08-13 19:32 ` Artem Bityutskiy
2026-08-13 20:14 ` Edgecombe, Rick P
2026-08-14 5:45 ` Artem Bityutskiy
2026-08-14 7:37 ` Peter Fang
2026-08-14 15:55 ` Edgecombe, Rick P
2026-08-15 11:39 ` Artem Bityutskiy
2026-08-17 17:26 ` Edgecombe, Rick P
2026-08-18 11:09 ` Artem Bityutskiy
2026-08-18 20:37 ` Sean Christopherson
2026-08-18 23:46 ` Edgecombe, Rick P
2026-08-19 14:57 ` Artem Bityutskiy
2026-08-12 23:27 ` Peter Fang
2026-08-12 21:02 ` Peter Fang
2026-08-27 22:22 ` Peter Fang
2026-08-27 22:41 ` Edgecombe, Rick P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apkcFclEw1LNd96h@intel.com \
--to=peter.fang@intel.com \
--cc=kvm@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.