FAILED: patch "[PATCH] virt: tdx-guest: Fix handling of host controlled 'quote'" failed to apply to 6.12-stable tree

PATCH Superseded [email protected] 2 participants 3 messages Mar 29

Subsystems (2)

Stable branch x86 trust domain extensions (TDX)

lore

Share & tools

lore

[email protected]

author maintainer

2026-03-29 12:40 UTC #0 lore raw

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x c3fd16c3b98ed726294feab2f94f876290bf7b61
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026032948-available-paternity-6929@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From c3fd16c3b98ed726294feab2f94f876290bf7b61 Mon Sep 17 00:00:00 2001
From: Zubin Mithra <[email protected]>
Date: Wed, 18 Mar 2026 13:40:13 +0000
Subject: [PATCH] virt: tdx-guest: Fix handling of host controlled 'quote'
buffer length

Validate host controlled value quote_buf->out_len that determines how many bytes of the quote are copied out to guest userspace. In TDX environments with remote attestation, quotes are not considered private, and can be forwarded to an attestation server.

Catch scenarios where the host specifies a response length larger than the guest's allocation, or otherwise races modifying the response while the guest consumes it.

This prevents contents beyond the pages allocated for quote_buf (up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace, and possibly forwarded in attestation requests.

Recall that some deployments want per-container configs-tsm-report interfaces, so the leak may cross container protection boundaries, not just local root.

Fixes f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS")

Cc [email protected]

Signed-off-by Zubin Mithra <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Reviewed-by Kiryl Shutsemau (Meta) <[email protected]>

Reviewed-by Kuppuswamy Sathyanarayanan <[email protected]>

Signed-off-by Dan Williams <[email protected]>

drivers/virt/coco/tdx-guest/tdx-guest.c +10 -2

index 4252b147593a..7cee97559ba2 100644
@@ -171,6 +171,8 @@ static void tdx_mr_deinit(const struct attribute_group *mr_grp)
 #define GET_QUOTE_SUCCESS		0
 #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
 
+#define TDX_QUOTE_MAX_LEN		(GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
+
 /* struct tdx_quote_buf: Format of Quote request buffer.
  * @version: Quote format version, filled by TD.
  * @status: Status code of Quote request, filled by VMM.

@@ -269,6 +271,7 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 	u8 *buf;
 	struct tdx_quote_buf *quote_buf = quote_data;
 	struct tsm_report_desc *desc = &report->desc;
+	u32 out_len;
 	int ret;
 	u64 err;

@@ -306,12 +309,17 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data)
 		return ret;
 	}
 
-	buf = kvmemdup(quote_buf->data, quote_buf->out_len, GFP_KERNEL);
+	out_len = READ_ONCE(quote_buf->out_len);
+
+	if (out_len > TDX_QUOTE_MAX_LEN)
+		return -EFBIG;
+
+	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
 	report->outblob = buf;
-	report->outblob_len = quote_buf->out_len;
+	report->outblob_len = out_len;
 
 	/*
 	 * TODO: parse the PEM-formatted cert chain out of the quote buffer when

Zubin Mithra

2026-03-29 20:48 UTC #1 lore raw

PATCH 1/1 virt: tdx-guest: Fix handling of host controlled 'quote' buffer length

commit c3fd16c3b98ed726294feab2f94f876290bf7b61 upstream.

Catch scenarios where the host specifies a response length larger than the guest's allocation, or otherwise races modifying the response while the guest consumes it.

This prevents contents beyond the pages allocated for quote_buf (up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace, and possibly forwarded in attestation requests.

Recall that some deployments want per-container configs-tsm-report interfaces, so the leak may cross container protection boundaries, not just local root.

Fixes f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS")

Cc [email protected]

Signed-off-by Zubin Mithra <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Reviewed-by Kiryl Shutsemau (Meta) <[email protected]>

Reviewed-by Kuppuswamy Sathyanarayanan <[email protected]>

Signed-off-by Dan Williams <[email protected]>

Signed-off-by Zubin Mithra <[email protected]>

---
 drivers/virt/coco/tdx-guest/tdx-guest.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

drivers/virt/coco/tdx-guest/tdx-guest.c +12 -2

index c4f25c173383..d7ec140fe90c 100644
@@ -61,6 +61,8 @@ static u64 tdx_hcall_get_quote_wrapper(u8 *buf, size_t size)
 #define GET_QUOTE_SUCCESS		0
 #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
 
+#define TDX_QUOTE_MAX_LEN              (GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
+
 /* struct tdx_quote_buf: Format of Quote request buffer.
  * @version: Quote format version, filled by TD.
  * @status: Status code of Quote request, filled by VMM.

@@ -192,6 +194,7 @@ VISIBLE_IF_KUNIT int tdx_report_new(struct tsm_report *report, void *data)
 	u8 *buf, *reportdata = NULL, *tdreport = NULL;
 	struct tdx_quote_buf *quote_buf = quote_data;
 	struct tsm_desc *desc = &report->desc;
+	u32 out_len;
 	int ret;
 	u64 err;

@@ -256,14 +259,21 @@ VISIBLE_IF_KUNIT int tdx_report_new(struct tsm_report *report, void *data)
 		goto done;
 	}
 
-	buf = kvmemdup(quote_buf->data, quote_buf->out_len, GFP_KERNEL);
+	out_len = READ_ONCE(quote_buf->out_len);
+
+	if (out_len > TDX_QUOTE_MAX_LEN) {
+		ret = -EFBIG;
+		goto done;
+	}
+
+	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
 	if (!buf) {
 		ret = -ENOMEM;
 		goto done;
 	}
 
 	report->outblob = buf;
-	report->outblob_len = quote_buf->out_len;
+	report->outblob_len = out_len;
 
 	/*
 	 * TODO: parse the PEM-formatted cert chain out of the quote buffer when

Signature · 1 line

2.53.0.1018.g2bb0e51243-goog

Zubin Mithra

2026-03-29 21:02 UTC #2 lore raw

PATCH v2 1/1 virt: tdx-guest: Fix handling of host controlled 'quote' buffer length

In reply to [email protected]

commit c3fd16c3b98ed726294feab2f94f876290bf7b61 upstream.

Catch scenarios where the host specifies a response length larger than the guest's allocation, or otherwise races modifying the response while the guest consumes it.

This prevents contents beyond the pages allocated for quote_buf (up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace, and possibly forwarded in attestation requests.

Recall that some deployments want per-container configs-tsm-report interfaces, so the leak may cross container protection boundaries, not just local root.

Fixes f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS")

Cc [email protected]

Signed-off-by Zubin Mithra <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Reviewed-by Kiryl Shutsemau (Meta) <[email protected]>

Reviewed-by Kuppuswamy Sathyanarayanan <[email protected]>

Signed-off-by Dan Williams <[email protected]>

Signed-off-by Zubin Mithra <[email protected]>

---
 drivers/virt/coco/tdx-guest/tdx-guest.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

drivers/virt/coco/tdx-guest/tdx-guest.c +12 -2

index 224e7dde9cde..dc45e4c76a20 100644
@@ -35,6 +35,8 @@
 #define GET_QUOTE_SUCCESS		0
 #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
 
+#define TDX_QUOTE_MAX_LEN              (GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
+
 /* struct tdx_quote_buf: Format of Quote request buffer.
  * @version: Quote format version, filled by TD.
  * @status: Status code of Quote request, filled by VMM.

@@ -162,6 +164,7 @@ static int tdx_report_new(struct tsm_report *report, void *data)
 	u8 *buf, *reportdata = NULL, *tdreport = NULL;
 	struct tdx_quote_buf *quote_buf = quote_data;
 	struct tsm_desc *desc = &report->desc;
+	u32 out_len;
 	int ret;
 	u64 err;

@@ -226,14 +229,21 @@ static int tdx_report_new(struct tsm_report *report, void *data)
 		goto done;
 	}
 
-	buf = kvmemdup(quote_buf->data, quote_buf->out_len, GFP_KERNEL);
+	out_len = READ_ONCE(quote_buf->out_len);
+
+	if (out_len > TDX_QUOTE_MAX_LEN) {
+		ret = -EFBIG;
+		goto done;
+	}
+
+	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
 	if (!buf) {
 		ret = -ENOMEM;
 		goto done;
 	}
 
 	report->outblob = buf;
-	report->outblob_len = quote_buf->out_len;
+	report->outblob_len = out_len;
 
 	/*
 	 * TODO: parse the PEM-formatted cert chain out of the quote buffer when

Signature · 1 line

2.53.0.1018.g2bb0e51243-goog