linux-kernel - [PATCH] KVM: x86/mmu: Release the pfn in handle_abnormal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221021111932.3291560-1-tabba@google.com>
Date:   Fri, 21 Oct 2022 12:19:32 +0100
From:   Fuad Tabba <tabba@...gle.com>
To:     kvm@...r.kernel.org
Cc:     seanjc@...gle.com, pbonzini@...hat.com, tglx@...utronix.de,
        mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
        hpa@...or.com, will@...nel.org, tabba@...gle.com, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] KVM: x86/mmu: Release the pfn in handle_abnormal_pfn() error path

Currently in case of error it returns without releasing the pfn
faulted in earlier.

Signed-off-by: Fuad Tabba <tabba@...gle.com>
---

Applies to 6.1-rc1. I think that kvm_release_pfn_clean() has been
replaced with kvm_mmu_release_fault() in development branches,
but the same issue is still there.
---
 arch/x86/kvm/mmu/mmu.c         | 3 ++-
 arch/x86/kvm/mmu/paging_tmpl.h | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 6f81539061d6..9adae837ccdd 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4250,7 +4250,7 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 
 	r = handle_abnormal_pfn(vcpu, fault, ACC_ALL);
 	if (r != RET_PF_CONTINUE)
-		return r;
+		goto out_release;
 
 	r = RET_PF_RETRY;
 
@@ -4276,6 +4276,7 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 		read_unlock(&vcpu->kvm->mmu_lock);
 	else
 		write_unlock(&vcpu->kvm->mmu_lock);
+out_release:
 	kvm_release_pfn_clean(fault->pfn);
 	return r;
 }
diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
index 5ab5f94dcb6f..4a1e4e460990 100644
--- a/arch/x86/kvm/mmu/paging_tmpl.h
+++ b/arch/x86/kvm/mmu/paging_tmpl.h
@@ -847,7 +847,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 
 	r = handle_abnormal_pfn(vcpu, fault, walker.pte_access);
 	if (r != RET_PF_CONTINUE)
-		return r;
+		goto out_release;
 
 	/*
 	 * Do not change pte_access if the pfn is a mmio page, otherwise
@@ -881,6 +881,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
 
 out_unlock:
 	write_unlock(&vcpu->kvm->mmu_lock);
+out_release:
 	kvm_release_pfn_clean(fault->pfn);
 	return r;
 }

base-commit: 9abf2313adc1ca1b6180c508c25f22f9395cc780
-- 
2.38.0.135.g90850a2211-goog