Re: [PATCH v7 21/42] KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGION

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Uninitialized host kernel memory is disclosed to TDX guests when performing in-place population.
--

commit 38e76d2ce3c699d4b64b580ab16a7b4cbc2b189a
Author: Ackerley Tng <ackerleytng@google.com>

KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGION

Update tdx_gmem_post_populate() to handle cases where a source page is not
explicitly provided. Instead of returning -EOPNOTSUPP when src_page is NULL,
default to using the page associated with the destination PFN, allowing
in-place memory conversion.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
[ ... ]
> @@ -3116,8 +3116,12 @@ static int tdx_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
>  	if (KVM_BUG_ON(kvm_tdx->page_add_src, kvm))
>  		return -EIO;
>  
> -	if (!src_page)
> -		return -EOPNOTSUPP;
> +	if (!src_page) {
> +		if (vm_memory_attributes)
> +			return -EOPNOTSUPP;
> +
> +		src_page = pfn_to_page(pfn);
> +	}

[Severity: Critical]
Can this sequence lead to uninitialized host memory being exposed to the guest
if the guest_memfd folio has not yet been populated?

When KVM_TDX_INIT_MEM_REGION is called with a NULL source_addr,
__kvm_gmem_populate() attempts an in-place conversion. If the target
guest_memfd folio is unpopulated, __kvm_gmem_get_pfn() allocates a new folio
using GFP_HIGHUSER, which lacks __GFP_ZERO.

Because __kvm_gmem_populate() bypasses the normal kvm_gmem_get_pfn() zeroing
path (where clear_highpage() is called for !folio_test_uptodate()), the
allocated page contains uninitialized host memory.

Since src_page is set to the same physical page here, will the TDX module
read this uninitialized host memory using the host KeyID and encrypt it into
the guest's private memory space during the TDH.MEM.PAGE.ADD SEAMCALL?

Could a malicious unprivileged VMM exploit this regression by passing a NULL
source_addr on an unmapped guest_memfd region, causing arbitrary host kernel
memory to be disclosed to the TDX guest?

>  
>  	kvm_tdx->page_add_src = src_page;
>  	ret = kvm_tdp_mmu_map_private_pfn(arg->vcpu, gfn, pfn);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260522-gmem-inplace-conversion-v7-0-2f0fae496530@google.com?part=21