Re: [PATCH 2/2] virt: tdx-guest: Allocate Quote buffer dynamically

[Peter Fang <peter.fang@intel.com>]

On Fri, Jun 12, 2026 at 11:22:02AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Unbounded host-provided quote size causes guest kernel warning (and potential panic) during allocation.
> --
> 
> commit 918e9fdc48e5a03b41dab3a999be1a3f631327c1
> Author: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> 
> virt: tdx-guest: Allocate Quote buffer dynamically
> 
> This commit modifies the TDX attestation driver to allocate the Quote
> buffer dynamically based on the size reported by the TDX module. It falls
> back to a default 128 KB buffer if the reported size is unavailable,
> supporting larger quotes needed for newer schemes.
> 
> > +
> > +static void *alloc_quote_buf(size_t *buflen)
> > +{
> > +	unsigned int count;
> > +	size_t len;
> >  	void *addr;
> >  
> > +	len = get_quote_buf_size();
> > +
> > +	/*
> > +	 * This fails if the requested size exceeds the buddy allocator's
> > +	 * maximum order (order-10, 4MB).
> > +	 */
> >  	addr = alloc_pages_exact(len, GFP_KERNEL | __GFP_ZERO);
> 
> [Severity: High]
> If the host provides an excessively large quote_sz, could this allocation
> trigger a kernel warning?
> 
> The comments indicate the buddy allocator will fail requests exceeding
> its maximum order. However, passing an unbounded, host-controlled size
> directly to alloc_pages_exact() without __GFP_NOWARN will trigger a
> WARN_ON_ONCE_GFP in the page allocator's slow path before failing.
> 
> If a host is malicious or misconfigured, could this be used to spam the
> guest's kernel log or cause a denial-of-service crash if the guest runs
> with panic_on_warn=1?
> 
> Would it be better to explicitly check the size against a reasonable upper
> bound or include the __GFP_NOWARN flag here?

Good point. I'll add __GFP_NOWARN here since the host is untrusted.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260612110853.3188196-1-peter.fang@intel.com?part=2