[PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes

[PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes

[Sean Christopherson]

I completely lost track of this, meant to post these patches weeks ago.
Compile tested only.

v2:
 - Fix an off-by-one bug.
 - Use gpa_t instead of raw u64.
 - Tweak the order of checks to bundle similar checks together, and to perform
   the super basic checks (alignment, size, etc.) first.

v1: https://lore.kernel.org/all/ak0skG064rhKUC8d@google.com

Haotian Jiang (1):
  KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a
    u64

Sean Christopherson (1):
  KVM: TDX: Fix a benign off-by-one bug on the end GPA for
    INIT_MEM_REGION

 arch/x86/kvm/vmx/tdx.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)


base-commit: a806d364ef288a6443a1337820ea8410a7ccc6b3
-- 
2.55.0.679.g6767b8d81c-goog

[PATCH v2 1/2] KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64

[Sean Christopherson]

From: Haotian Jiang <jianghaotian.sunday@gmail.com>

The nr_pages field in struct kvm_tdx_init_mem_region is a u64 that comes
directly from userspace via copy_from_user().  The current validation
uses a manual overflow check:

  region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa

When nr_pages >= 2^52, the shift (nr_pages << PAGE_SHIFT) wraps around
to a small value, bypassing the wrap check.  While downstream protections
(gfn_to_memslot() returning NULL for GFNs outside any memslot, and
kvm_slot_has_gmem() checking for NULL) prevent any actual out-of-bounds
access, the overflow itself is a real bug that should be caught at the
validation layer.

Replace the manual overflow check with check_shl_overflow() to correctly
detect the wrap-around.

Note, the manual wrap-around check on the gpa+size technically has a benign
off-by-one bug, and can also use check_add_overflow().  Those flaws will be
addressed shortly.

Opportunistically separate the initial sanity checks from the more involved
checks to try and make the code easier to read.

Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260630214952.98C851F000E9@smtp.kernel.org
Cc: Yan Zhao <yan.y.zhao@intel.com>
Cc: Binbin Wu <binbin.wu@linux.intel.com>
Cc: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
[sean: use gpa_t, isolate check_shl_overflow() change, tweak changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/tdx.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index b272c20586a7..929115aeb9ec 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -3219,6 +3219,7 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
 	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
 	struct kvm_tdx_init_mem_region region;
 	struct tdx_gmem_post_populate_arg arg;
+	gpa_t nr_bytes;
 	long gmem_ret;
 	int ret;
 
@@ -3236,10 +3237,13 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
 		return -EFAULT;
 
 	if (!PAGE_ALIGNED(region.source_addr) || !region.source_addr ||
-	    !PAGE_ALIGNED(region.gpa) || !region.nr_pages ||
-	    region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa ||
+	    !PAGE_ALIGNED(region.gpa) || !region.nr_pages)
+		return -EINVAL;
+
+	if (check_shl_overflow(region.nr_pages, PAGE_SHIFT, &nr_bytes) ||
+	    region.gpa + nr_bytes <= region.gpa ||
 	    !vt_is_tdx_private_gpa(kvm, region.gpa) ||
-	    !vt_is_tdx_private_gpa(kvm, region.gpa + (region.nr_pages << PAGE_SHIFT) - 1))
+	    !vt_is_tdx_private_gpa(kvm, region.gpa + nr_bytes - 1))
 		return -EINVAL;
 
 	ret = 0;
-- 
2.55.0.679.g6767b8d81c-goog

[PATCH v2 2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION

[Sean Christopherson]

When verifying that the incoming GPA rage for INIT_MEM_REGION doesn't wrap,
check the inclusive last GPA, not the exclusive last GPA.  Super duper
technically, it's ok if the very last GPA is -1ull.  In practice, the flaw
is benign as KVM x86 disallows memslots with GPAs that exceed MAXPHYADDR,
i.e. INIT_MEM_REGION would fail with -EINVAL anyways due to the memslot
check in kvm_gmem_populate().

Opportunistically use check_add_overflow() instead of manually checking for
wrap, mostly so that the inclusive math doesn't need to be copy+pasted in
the "is private" check.

Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/tdx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 929115aeb9ec..85699ea021fe 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -3219,7 +3219,7 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
 	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
 	struct kvm_tdx_init_mem_region region;
 	struct tdx_gmem_post_populate_arg arg;
-	gpa_t nr_bytes;
+	gpa_t nr_bytes, end_gpa;
 	long gmem_ret;
 	int ret;
 
@@ -3241,9 +3241,9 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
 		return -EINVAL;
 
 	if (check_shl_overflow(region.nr_pages, PAGE_SHIFT, &nr_bytes) ||
-	    region.gpa + nr_bytes <= region.gpa ||
+	    check_add_overflow(region.gpa, nr_bytes - 1, &end_gpa) ||
 	    !vt_is_tdx_private_gpa(kvm, region.gpa) ||
-	    !vt_is_tdx_private_gpa(kvm, region.gpa + nr_bytes - 1))
+	    !vt_is_tdx_private_gpa(kvm, end_gpa))
 		return -EINVAL;
 
 	ret = 0;
-- 
2.55.0.679.g6767b8d81c-goog

Re: [PATCH v2 1/2] KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64

[Yan Zhao]

On Thu, Aug 06, 2026 at 10:06:01AM -0700, Sean Christopherson wrote:
> From: Haotian Jiang <jianghaotian.sunday@gmail.com>
> 
> The nr_pages field in struct kvm_tdx_init_mem_region is a u64 that comes
> directly from userspace via copy_from_user().  The current validation
> uses a manual overflow check:
> 
>   region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa
> 
> When nr_pages >= 2^52, the shift (nr_pages << PAGE_SHIFT) wraps around
> to a small value, bypassing the wrap check.  While downstream protections
> (gfn_to_memslot() returning NULL for GFNs outside any memslot, and
> kvm_slot_has_gmem() checking for NULL) prevent any actual out-of-bounds
> access, the overflow itself is a real bug that should be caught at the
> validation layer.
> 
> Replace the manual overflow check with check_shl_overflow() to correctly
> detect the wrap-around.
> 
> Note, the manual wrap-around check on the gpa+size technically has a benign
> off-by-one bug, and can also use check_add_overflow().  Those flaws will be
> addressed shortly.
> 
> Opportunistically separate the initial sanity checks from the more involved
> checks to try and make the code easier to read.
> 
> Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
> Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260630214952.98C851F000E9@smtp.kernel.org
> Cc: Yan Zhao <yan.y.zhao@intel.com>
> Cc: Binbin Wu <binbin.wu@linux.intel.com>
> Cc: Ackerley Tng <ackerleytng@google.com>
> Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
> [sean: use gpa_t, isolate check_shl_overflow() change, tweak changelog]
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>

>  arch/x86/kvm/vmx/tdx.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index b272c20586a7..929115aeb9ec 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -3219,6 +3219,7 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
>  	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
>  	struct kvm_tdx_init_mem_region region;
>  	struct tdx_gmem_post_populate_arg arg;
> +	gpa_t nr_bytes;
>  	long gmem_ret;
>  	int ret;
>  
> @@ -3236,10 +3237,13 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
>  		return -EFAULT;
>  
>  	if (!PAGE_ALIGNED(region.source_addr) || !region.source_addr ||
> -	    !PAGE_ALIGNED(region.gpa) || !region.nr_pages ||
> -	    region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa ||
> +	    !PAGE_ALIGNED(region.gpa) || !region.nr_pages)
> +		return -EINVAL;
> +
> +	if (check_shl_overflow(region.nr_pages, PAGE_SHIFT, &nr_bytes) ||
> +	    region.gpa + nr_bytes <= region.gpa ||
>  	    !vt_is_tdx_private_gpa(kvm, region.gpa) ||
> -	    !vt_is_tdx_private_gpa(kvm, region.gpa + (region.nr_pages << PAGE_SHIFT) - 1))
> +	    !vt_is_tdx_private_gpa(kvm, region.gpa + nr_bytes - 1))
>  		return -EINVAL;
>  
>  	ret = 0;
> -- 
> 2.55.0.679.g6767b8d81c-goog
> 

Re: [PATCH v2 2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION

[Yan Zhao]

On Thu, Aug 06, 2026 at 10:06:02AM -0700, Sean Christopherson wrote:
> When verifying that the incoming GPA rage for INIT_MEM_REGION doesn't wrap,
> check the inclusive last GPA, not the exclusive last GPA.  Super duper
> technically, it's ok if the very last GPA is -1ull.  In practice, the flaw
> is benign as KVM x86 disallows memslots with GPAs that exceed MAXPHYADDR,
> i.e. INIT_MEM_REGION would fail with -EINVAL anyways due to the memslot
> check in kvm_gmem_populate().
> 
> Opportunistically use check_add_overflow() instead of manually checking for
> wrap, mostly so that the inclusive math doesn't need to be copy+pasted in
> the "is private" check.
> 
> Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>  arch/x86/kvm/vmx/tdx.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 929115aeb9ec..85699ea021fe 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -3219,7 +3219,7 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
>  	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
>  	struct kvm_tdx_init_mem_region region;
>  	struct tdx_gmem_post_populate_arg arg;
> -	gpa_t nr_bytes;
> +	gpa_t nr_bytes, end_gpa;
>  	long gmem_ret;
>  	int ret;
>  
> @@ -3241,9 +3241,9 @@ static int tdx_vcpu_init_mem_region(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *c
>  		return -EINVAL;
>  
>  	if (check_shl_overflow(region.nr_pages, PAGE_SHIFT, &nr_bytes) ||
> -	    region.gpa + nr_bytes <= region.gpa ||
> +	    check_add_overflow(region.gpa, nr_bytes - 1, &end_gpa) ||
Nit: explain in patch log that check_add_overflow() does not catch the case
where "nr_bytes == 0", unlike the check in "region.gpa + nr_bytes <= region.gpa"?
However, this is already guarded by the preceding "!region.nr_pages" check.

Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>

>  	    !vt_is_tdx_private_gpa(kvm, region.gpa) ||
> -	    !vt_is_tdx_private_gpa(kvm, region.gpa + nr_bytes - 1))
> +	    !vt_is_tdx_private_gpa(kvm, end_gpa))
>  		return -EINVAL;
>  
>  	ret = 0;
> -- 
> 2.55.0.679.g6767b8d81c-goog
> 

Re: [PATCH v2 1/2] KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64

[Binbin Wu]

On 8/7/2026 1:06 AM, Sean Christopherson wrote:
> From: Haotian Jiang <jianghaotian.sunday@gmail.com>
> 
> The nr_pages field in struct kvm_tdx_init_mem_region is a u64 that comes
> directly from userspace via copy_from_user().  The current validation
> uses a manual overflow check:
> 
>   region.gpa + (region.nr_pages << PAGE_SHIFT) <= region.gpa
> 
> When nr_pages >= 2^52, the shift (nr_pages << PAGE_SHIFT) wraps around
> to a small value, bypassing the wrap check.  While downstream protections
> (gfn_to_memslot() returning NULL for GFNs outside any memslot, and
> kvm_slot_has_gmem() checking for NULL) prevent any actual out-of-bounds
> access, the overflow itself is a real bug that should be caught at the
> validation layer.
> 
> Replace the manual overflow check with check_shl_overflow() to correctly
> detect the wrap-around.
> 
> Note, the manual wrap-around check on the gpa+size technically has a benign
> off-by-one bug, and can also use check_add_overflow().  Those flaws will be
> addressed shortly.
> 
> Opportunistically separate the initial sanity checks from the more involved
> checks to try and make the code easier to read.
> 
> Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
> Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260630214952.98C851F000E9@smtp.kernel.org
> Cc: Yan Zhao <yan.y.zhao@intel.com>
> Cc: Binbin Wu <binbin.wu@linux.intel.com>
> Cc: Ackerley Tng <ackerleytng@google.com>
> Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
> [sean: use gpa_t, isolate check_shl_overflow() change, tweak changelog]
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

Re: [PATCH v2 2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION

[Binbin Wu]

On 8/7/2026 1:06 AM, Sean Christopherson wrote:
> When verifying that the incoming GPA rage for INIT_MEM_REGION doesn't wrap,
> check the inclusive last GPA, not the exclusive last GPA.  Super duper
> technically, it's ok if the very last GPA is -1ull.  In practice, the flaw
> is benign as KVM x86 disallows memslots with GPAs that exceed MAXPHYADDR,
> i.e. INIT_MEM_REGION would fail with -EINVAL anyways due to the memslot
> check in kvm_gmem_populate().
> 
> Opportunistically use check_add_overflow() instead of manually checking for
> wrap, mostly so that the inclusive math doesn't need to be copy+pasted in
> the "is private" check.
> 
> Fixes: c846b451d3c5 ("KVM: TDX: Add an ioctl to create initial guest memory")
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>

Re: [PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes

[Sean Christopherson]

On Thu, 06 Aug 2026 10:06:00 -0700, Sean Christopherson wrote:
> I completely lost track of this, meant to post these patches weeks ago.
> Compile tested only.
> 
> v2:
>  - Fix an off-by-one bug.
>  - Use gpa_t instead of raw u64.
>  - Tweak the order of checks to bundle similar checks together, and to perform
>    the super basic checks (alignment, size, etc.) first.
> 
> [...]

Applied to kvm-x86 vmx, thanks!

[1/2] KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a u64
      https://github.com/kvm-x86/linux/commit/7c9a2e3a4564
[2/2] KVM: TDX: Fix a benign off-by-one bug on the end GPA for INIT_MEM_REGION
      https://github.com/kvm-x86/linux/commit/872aae89167c

--
https://github.com/kvm-x86/linux/tree/next

Re: [PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes

[Ackerley Tng]

Sean Christopherson <seanjc@google.com> writes:

> I completely lost track of this, meant to post these patches weeks ago.
> Compile tested only.
>
> v2:
>  - Fix an off-by-one bug.
>  - Use gpa_t instead of raw u64.
>  - Tweak the order of checks to bundle similar checks together, and to perform
>    the super basic checks (alignment, size, etc.) first.
>
> v1: https://lore.kernel.org/all/ak0skG064rhKUC8d@google.com
>
> Haotian Jiang (1):
>   KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a
>     u64
>
> Sean Christopherson (1):
>   KVM: TDX: Fix a benign off-by-one bug on the end GPA for
>     INIT_MEM_REGION
>
>  arch/x86/kvm/vmx/tdx.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
>
> base-commit: a806d364ef288a6443a1337820ea8410a7ccc6b3
> --
> 2.55.0.679.g6767b8d81c-goog

Looks good to me, just a question on the use of check_*_overflow: I
thought Sean didn't like burying an out-param in an if-statement? [1]

[1] https://lore.kernel.org/all/ag8BmtzxTlcuA_zy@google.com/

Reviewed-by: Ackerley Tng <ackerleytng@google.com>

Re: [PATCH v2 0/2] KVM: TDX: INIT_MEM_REGION fixes

[Sean Christopherson]

On Tue, Sep 22, 2026, Ackerley Tng wrote:
> Sean Christopherson <seanjc@google.com> writes:
> 
> > I completely lost track of this, meant to post these patches weeks ago.
> > Compile tested only.
> >
> > v2:
> >  - Fix an off-by-one bug.
> >  - Use gpa_t instead of raw u64.
> >  - Tweak the order of checks to bundle similar checks together, and to perform
> >    the super basic checks (alignment, size, etc.) first.
> >
> > v1: https://lore.kernel.org/all/ak0skG064rhKUC8d@google.com
> >
> > Haotian Jiang (1):
> >   KVM: TDX: Reject INIT_MEM_REGION if number of bytes would overflow a
> >     u64
> >
> > Sean Christopherson (1):
> >   KVM: TDX: Fix a benign off-by-one bug on the end GPA for
> >     INIT_MEM_REGION
> >
> >  arch/x86/kvm/vmx/tdx.c | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)
> >
> >
> > base-commit: a806d364ef288a6443a1337820ea8410a7ccc6b3
> > --
> > 2.55.0.679.g6767b8d81c-goog
> 
> Looks good to me, just a question on the use of check_*_overflow: I
> thought Sean didn't like burying an out-param in an if-statement? [1]

I don't, but in this case I found it to be the lesser evil.  I think it helps
that both the out-params are used only in the same if-statement.  One could argue
that's even *more* evil, but t doesn't "surprise" me as much, e.g. I'm not having
to hunt for where some variable in the main loop is set.

> [1] https://lore.kernel.org/all/ag8BmtzxTlcuA_zy@google.com