Re: [PATCH v5 5/5] KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] kvm: KVM_TDX_INIT_VM rejects CPUID.0x7.0.EAX breaking guest subleaf enumeration
- [High] mm: heap buffer overflow in setup_tdparams_cpuids() via unbounded td_conf->num_cpuid_config
--

commit 8ec54e6006917e96837000de9e4002c7f4499444
Author: Binbin Wu <binbin.wu@linux.intel.com>

KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

This commit validates the CPUID configuration provided by userspace
through KVM_TDX_INIT_VM against KVM's TDX allowlist. It drops the
hardcoded denylist-based check in favor of a strict allowlist.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index e53f1e98bb04a..80c6519c13ff5 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
[ ... ]
> @@ -2567,6 +2548,14 @@ static int setup_tdparams_eptp_controls(struct kvm_cpuid2 *cpuid,
>  	return 0;
>  }
>  
> +static bool tdx_has_unsupported_cpuid_cfg_bit(const struct kvm_cpuid_entry2 *e, u32 index)
> +{
> +	return (e->eax & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EAX)) ||
> +	       (e->ebx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EBX)) ||
> +	       (e->ecx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_ECX)) ||
> +	       (e->edx & ~tdx_get_cpuid_cfg_mask(e->function, index, CPUID_EDX));
> +}

[Severity: High]
Does this strict allowlist check inadvertently break guest subleaf enumeration
by rejecting valid KVM_TDX_INIT_VM inputs?

CPUID leaf 0x7 subleaf 0 EAX contains the maximum supported subleaf index,
which is non-feature information. However, tdx_get_cpuid_cfg_non_feature_mask()
completely omits leaf 0x7, and reverse_cpuid does not track 0x7.0.EAX as a
feature word.

Because tdx_get_cpuid_cfg_mask(0x7, 0, CPUID_EAX) returns 0, this new check
will reject any non-zero value for CPUID.0x7.0.EAX. This strictly requires
userspace to provide 0, effectively preventing exposure of subleaves 1+
(such as for AMX or AVX-VNNI) and breaking valid VM initialization requests.

>  static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
>  				 struct td_params *td_params)
>  {
[ ... ]
> @@ -2596,7 +2585,7 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
>  		 * not the index of the userspace entry, which may differ if
>  		 * KVM_CPUID_FLAG_SIGNIFCANT_INDEX isn't set.
>  		 */
> -		if (tdx_unsupported_cpuid(entry, tmp.index))
> +		if (tdx_has_unsupported_cpuid_cfg_bit(entry, tmp.index))
>  			return -EINVAL;
>  
>  		copy_cnt++;

[Severity: High]
Can the loop enclosing this code write past the end of the td_params heap
allocation?

td_conf->num_cpuid_config is read from the TDX module and bounded to 128
by KVM in get_tdx_sys_info_td_conf():

	if (sysinfo_td_conf->num_cpuid_config > ARRAY_SIZE(sysinfo_td_conf->cpuid_config_leaves))
		return -EINVAL;

However, td_params->cpuid_values is an array inside a union with
u8 reserved3[768], which limits it to 48 tdx_cpuid_value structures:

arch/x86/kvm/vmx/tdx_arch.h:struct td_params {
    ...
    union {
        DECLARE_FLEX_ARRAY(struct tdx_cpuid_value, cpuid_values);
        u8 reserved3[768];
    };
} __packed __aligned(1024);

td_params itself is dynamically allocated as a fixed 1024-byte object via
kzalloc_obj(struct td_params) in setup_tdparams().

If the hardware returns a num_cpuid_config value greater than 48, the loop
in setup_tdparams_cpuids() will exceed the 48-element capacity when assigning
value = &td_params->cpuid_values[i] just below this snippet, causing a heap
buffer overflow.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016091422.3182216-1-binbin.wu@linux.intel.com?part=5