Re: [PATCH RFC 20/20] attestation: Add the TDX family implementation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] mm: memory accounting bypass via missing __GFP_ACCOUNT in attestation_tdx_evidence_get
--

commit 70d54896a73342be7665edff009c1c4b80f13008
Author: Jiri Pirko <jiri@nvidia.com>

attestation: Add the TDX family implementation

This commit connects the attestation family to the native TDX service. It
exposes TDREPORT, Quote, MRTD, and RTMR operations while preserving the
existing native interfaces.

> diff --git a/drivers/attestation/providers/tdx.c b/drivers/attestation/providers/tdx.c
> new file mode 100644
> --- /dev/null
> +++ b/drivers/attestation/providers/tdx.c

[ ... ]

> +static int
> +attestation_tdx_evidence_get(struct attestation *att,
> +			     const struct attestation_evidence_request *request,
> +			     struct attestation_evidence_result *result)
> +{
> +	const struct attestation_evidence_object_request *object;
> +	struct attestation_tdx *tdx = ctlv_priv_child(att);
> +	size_t length;
> +	void *buffer;
> +	int ret;
> +
> +	if (request->objects_count != 1)
> +		return -EOPNOTSUPP;
> +	object = &request->objects[0];
> +	buffer = kvmalloc(object->supported_object->max_length, GFP_KERNEL);

[Severity: Medium]
Does this allocation need the __GFP_ACCOUNT flag?

The buffer size for a TDX Quote can be up to TDX_GUEST_QUOTE_MAX_LEN
(approximately 128KB). This operation proceeds to call
tdx->ops->quote_get(), which acquires the global quote_lock mutex in the
tdx-guest driver.

If userspace issues concurrent quote requests, tasks will block on this
mutex while holding these large, unaccounted buffers. Can this allow a
container to accumulate a significant amount of kernel memory that bypasses
memcg limits, potentially leading to host out-of-memory conditions?

> +	if (!buffer)
> +		return -ENOMEM;
> +	if (object->supported_object == &attestation_tdx_evidence_objects[0])
> +		ret = tdx->ops->report_get(tdx->parent_dev,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015145053.3664509-1-jiri@resnulli.us?part=20