Re: [PATCH v5 5/5] KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

[Binbin Wu <binbin.wu@linux.intel.com>]

On 10/16/2026 5:24 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] kvm: KVM_TDX_INIT_VM rejects CPUID.0x7.0.EAX breaking guest subleaf enumeration
> - [High] mm: heap buffer overflow in setup_tdparams_cpuids() via unbounded td_conf->num_cpuid_config
> --
> 
> commit 8ec54e6006917e96837000de9e4002c7f4499444
> Author: Binbin Wu <binbin.wu@linux.intel.com>
> 
> KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM
> 
> This commit validates the CPUID configuration provided by userspace
> through KVM_TDX_INIT_VM against KVM's TDX allowlist. It drops the
> hardcoded denylist-based check in favor of a strict allowlist.
> 
>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>> index e53f1e98bb04a..80c6519c13ff5 100644
>> --- a/arch/x86/kvm/vmx/tdx.c
>> +++ b/arch/x86/kvm/vmx/tdx.c
> [ ... ]
>> @@ -2567,6 +2548,14 @@ static int setup_tdparams_eptp_controls(struct kvm_cpuid2 *cpuid,
>>  	return 0;
>>  }
>>  
>> +static bool tdx_has_unsupported_cpuid_cfg_bit(const struct kvm_cpuid_entry2 *e, u32 index)
>> +{
>> +	return (e->eax & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EAX)) ||
>> +	       (e->ebx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EBX)) ||
>> +	       (e->ecx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_ECX)) ||
>> +	       (e->edx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EDX));
>> +}
> 
> [Severity: High]
> Does this strict allowlist check inadvertently break guest subleaf enumeration
> by rejecting valid KVM_TDX_INIT_VM inputs?
> 
> CPUID leaf 0x7 subleaf 0 EAX contains the maximum supported subleaf index,
> which is non-feature information. However, tdx_get_cpuid_cfg_non_feature_mask()
> completely omits leaf 0x7, and reverse_cpuid does not track 0x7.0.EAX as a
> feature word.
> 
> Because tdx_get_cpuid_cfg_mask(0x7, 0, CPUID_EAX) returns 0, this new check
> will reject any non-zero value for CPUID.0x7.0.EAX. This strictly requires
> userspace to provide 0, effectively preventing exposure of subleaves 1+
> (such as for AMX or AVX-VNNI) and breaking valid VM initialization requests.

This is false positive.

CPUID.0.EAX is not directly configurable in TDX.
Userspace is not allowed to provide non-zero value for it.

> 
>>  static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
>>  				 struct td_params *td_params)
>>  {
> [ ... ]
>> @@ -2596,7 +2585,7 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
>>  		 * not the index of the userspace entry, which may differ if
>>  		 * KVM_CPUID_FLAG_SIGNIFCANT_INDEX isn't set.
>>  		 */
>> -		if (tdx_unsupported_cpuid(entry, tmp.index))
>> +		if (tdx_has_unsupported_cpuid_cfg_bit(entry, tmp.index))
>>  			return -EINVAL;
>>  
>>  		copy_cnt++;
> 
> [Severity: High]
> Can the loop enclosing this code write past the end of the td_params heap
> allocation?
> 
> td_conf->num_cpuid_config is read from the TDX module and bounded to 128
> by KVM in get_tdx_sys_info_td_conf():
> 
> 	if (sysinfo_td_conf->num_cpuid_config > ARRAY_SIZE(sysinfo_td_conf->cpuid_config_leaves))
> 		return -EINVAL;
> 
> However, td_params->cpuid_values is an array inside a union with
> u8 reserved3[768], which limits it to 48 tdx_cpuid_value structures:
> 
> arch/x86/kvm/vmx/tdx_arch.h:struct td_params {
>     ...
>     union {
>         DECLARE_FLEX_ARRAY(struct tdx_cpuid_value, cpuid_values);
>         u8 reserved3[768];
>     };
> } __packed __aligned(1024);
> 
> td_params itself is dynamically allocated as a fixed 1024-byte object via
> kzalloc_obj(struct td_params) in setup_tdparams().
> 
> If the hardware returns a num_cpuid_config value greater than 48, the loop
> in setup_tdparams_cpuids() will exceed the 48-element capacity when assigning
> value = &td_params->cpuid_values[i] just below this snippet, causing a heap
> buffer overflow.
> 

Here is the to reply to the same issue reported in an earlier version:
https://lore.kernel.org/kvm/c31eb9c5-6cae-488a-bcaf-26160c282e0b@linux.intel.com/