Re: [PATCH v10 05/11] x86/virt/tdx: Handle multiple callers in tdx_pamt_get/put()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tdx_find_dpamt_refcount() uses an unchecked PFN to index the dpamt_refcounts array, leading to out-of-bounds memory access.
--

commit 413476a1747fac53ffdaf87030c42cb8b25bc668
Author: Rick Edgecombe <rick.p.edgecombe@intel.com>

x86/virt/tdx: Handle multiple callers in tdx_pamt_get/put()

This patch refcounts the dynamic PAMT additions for 2MB regions so multiple
callers can safely share them. It also drops the "__" prefix from the
helpers and exports them for use by KVM.

> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index e8bdeacd989d6..a126e395f5f6a 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c
> @@ -292,7 +292,7 @@ static __init void free_dpamt_refcounts(void)
>  	dpamt_refcounts = NULL;
>  }
>  
> -static __maybe_unused atomic_t *tdx_find_dpamt_refcount(unsigned long pfn)
> +static atomic_t *tdx_find_dpamt_refcount(unsigned long pfn)
>  {
>  	/* Find which PMD a PFN is in. */
>  	unsigned long index = pfn >> (PMD_SHIFT - PAGE_SHIFT);
> 
>  	return &dpamt_refcounts[index];

[Severity: High]
Does this index calculation need bounds checking?

If memory is hotplugged after boot, increasing the global max_pfn, and KVM
allocates private guest memory that lands in this hotplugged region (e.g.,
via guest_memfd), the returned PFN could be greater than the boot-time
max_pfn used to size the dpamt_refcounts array. This would lead to an
out-of-bounds pointer being returned here.

[ ... ]

> @@ -2150,41 +2144,59 @@ static int __tdx_pamt_get(kvm_pfn_t pfn)
[ ... ]
>  out_free:
> +	spin_unlock(&dpamt_lock);
>  	free_pamt_array(pamt_pages);
>  
>  	return ret;
>  }
> +EXPORT_SYMBOL_FOR_KVM(tdx_pamt_get);

[Severity: High]
Is it safe to export this function without adding bounds checking to
tdx_find_dpamt_refcount()?

Exporting this helper allows external callers like KVM to pass in arbitrary
or hotplugged PFNs. If a hotplugged PFN is passed, the resulting
out-of-bounds pointer from tdx_find_dpamt_refcount() will be modified by
atomic_inc_not_zero() and atomic_set() within this function, potentially
causing memory corruption or a host kernel panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903015113.93343-1-rick.p.edgecombe@intel.com?part=5