Skip to contentSkip to conversation

KVM: arm64: Fix page leak in user_mem_abort()

PATCH Applied Fuad Tabba 3 participants 3 messages Sep 17, 2025

Subsystems (2)
arm64 KVM arm64
lore
Share & tools
lore

Fuad Tabba

author
#0 lore raw

PATCH 1/1 KVM: arm64: Fix page leak in user_mem_abort()

The user_mem_abort() function acquires a page reference via __kvm_faultin_pfn() early in its execution. However, the subsequent checks for mismatched attributes between stage 1 and stage 2 mappings would return an error code directly, bypassing the corresponding page release.

Fix this by storing the error and releasing the unused page before returning the error.

Fixes 6d674e28f642 ("KVM: arm/arm64: Properly handle faulting of device mappings")
Fixes 2a8dfab26677 ("KVM: arm64: Block cacheable PFNMAP mapping")
Signed-off-by Fuad Tabba <[email protected]>

---
Based on Linux 6.17-rc6

---
 arch/arm64/kvm/mmu.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm64/kvm/mmu.c +7 -2
index 86f3d80daf37..d57afca8afb4 100644
@@ -1706,7 +1706,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
 			 * cache maintenance.
 			 */
 			if (!kvm_supports_cacheable_pfnmap())
-				return -EFAULT;
+				ret = -EFAULT;
 		} else {
 			/*
 			 * If the page was identified as device early by looking at

@@ -1729,7 +1729,12 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
 	}
 
 	if (exec_fault && s2_force_noncacheable)
-		return -ENOEXEC;
+		ret = -ENOEXEC;
+
+	if (ret) {
+		kvm_release_page_unused(page);
+		return ret;
+	}
 
 	/*
 	 * Potentially reduce shadow S2 permissions to match the guest's own

base-commit: f83ec76bf285bea5727f478a68b894f5543ca76e

Signature · 1 line
2.51.0.384.g4c02a37b29-goog
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · Fuad Tabba

The user_mem_abort() function acquires a page reference via __kvm_faultin_pfn() early in its execution. However, the subsequent checks for mismatched attributes between stage 1 and stage 2 mappings would return an error code directly, bypassing the corresponding page release.

Quoted 6 lines

Fix this by storing the error and releasing the unused page before returning the error.

Fixes 6d674e28f642 ("KVM: arm/arm64: Properly handle faulting of device mappings")
Fixes 2a8dfab26677 ("KVM: arm64: Block cacheable PFNMAP mapping")
Signed-off-by Fuad Tabba <[email protected]>

Yikes, nice catch.

Reviewed-by Oliver Upton <[email protected]>

Thanks,
Oliver

maintainer Applied
#2 lore raw
In reply to Fuad Tabba
Quoted 10 lines · Fuad Tabba

The user_mem_abort() function acquires a page reference via __kvm_faultin_pfn() early in its execution. However, the subsequent checks for mismatched attributes between stage 1 and stage 2 mappings would return an error code directly, bypassing the corresponding page release.

Fix this by storing the error and releasing the unused page before returning the error.

[...]

Applied to next, thanks!

[1/1] KVM: arm64: Fix page leak in user_mem_abort()

      commit: 5f9466b50c1b4253d91abf81780b90a722133162

Cheers,

	M.
Signature · 1 line
Without deviation from the norm, progress is not possible.