Re: [PATCH v3 4/6] Drivers: hv: Mark shared memory as decrypted for CCA Realms

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Using `kmalloc()` for memory passed to `set_memory_decrypted()` causes silent memory corruption on x86 and initialization failures on ARM64 due to a lack of strict page alignment and KASAN/MTE pointer tagging.
--

--- Patch [4]: [PATCH v3 4/6] Drivers: hv: Mark shared memory as decrypted for CCA Realms ---
commit 21b5c4cec77eb56971c17ededee7133820fad287
Author: Kameron Carr <kameroncarr@linux.microsoft.com>

Drivers: hv: Mark shared memory as decrypted for CCA Realms

This patch extends confidential VM isolation memory decryption to Arm CCA Realm
guests during hypercall memory initialization. It introduces a helper for CCA
isolation and updates the hypercall buffer allocation path to use it.

> diff --git a/drivers/hv/hv_common.c b/drivers/hv/hv_common.c
> index 6b67ac6167891..0f9412fcb9571 100644
> --- a/drivers/hv/hv_common.c
> +++ b/drivers/hv/hv_common.c
[ ... ]
> @@ -489,7 +490,7 @@ int hv_common_cpu_init(unsigned int cpu)
>  	 * online and then taken offline
>  	 */
>  	if (!*inputarg) {
> -		mem = kmalloc_array(pgcount, HV_HYP_PAGE_SIZE, flags);
> +		mem = kmalloc(alloc_size, flags);
>  		if (!mem)
>  			return -ENOMEM;
>  
> @@ -499,14 +500,16 @@ int hv_common_cpu_init(unsigned int cpu)
>  		}
>  
>  		if (!ms_hyperv.paravisor_present &&
> -		    (hv_isolation_type_snp() || hv_isolation_type_tdx())) {
> -			ret = set_memory_decrypted((unsigned long)mem, pgcount);
> +		    (hv_isolation_type_snp() || hv_isolation_type_tdx() ||
> +		     hv_isolation_type_cca())) {
> +			ret = set_memory_decrypted((unsigned long)mem,
> +						   alloc_size >> PAGE_SHIFT);

[Severity: High]
This isn't a bug introduced by this patch, but is it safe to pass memory 
allocated by kmalloc to set_memory_decrypted() in hv_common_cpu_init()?

When kmalloc is used with SLUB_DEBUG, the returned pointer is not strictly 
page-aligned. Because set_memory_decrypted() operates on page frames and
rounds down to the page boundary, this could silently decrypt adjacent slab
objects or metadata on x86 architectures.

Additionally, on arm64 systems with MTE enabled, kmalloc returns a tagged 
pointer. Passing a tagged pointer to set_memory_decrypted() causes its
internal __is_lm_address() check to fail, leading to initialization failures
during boot or CPU hotplug for CCA guests.

Would it be better to allocate this memory using the page allocator, such as 
with __get_free_pages(), to ensure the address is strictly page-aligned and 
untagged?

>  			if (ret) {
>  				/* It may be unsafe to free 'mem' */
>  				return ret;
>  			}
>  
> -			memset(mem, 0x00, pgcount * HV_HYP_PAGE_SIZE);
> +			memset(mem, 0x00, alloc_size);
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721201148.1441143-1-kameroncarr@linux.microsoft.com?part=4