From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 90CB21EE01A; Thu, 21 May 2026 01:18:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779326314; cv=none; b=mkAoCxfmZAHfIJcKLbPB3ektrUxtrSMJATxNH9fzzKTibnh8RqByRBU1iQJkSuK/3IPYr+zB7VgozVZNszhkZFg24N8/tPMsVKpAtew/m5stg4HDUmbCt+bbKAYzHiMSERfhVeGZpkM0QSpnf6zuoLAh+e4QFNHH4ife/FXEusc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779326314; c=relaxed/simple; bh=p108qyCkNoOszZgVUeVowVnGFQ0PVcWZy6iRL+vg5aE=; h=Date:From:To:Subject:Cc:MIME-Version:Message-ID:Content-Type; b=VyR6/LZua0R+p/uUERBKuIbOr+jjHbsXeiRwhDMnvZfpfvieApnt6eKdD03/QKhwvZZgi4/NmbdSTKD9rxEsBddNUVTwlyG37JO5KTdlRbW4HGF9hfWgtNFT49s+R2Z/GZtKaHGSE18OC5nqw/a4GFuo3gpLH852FnGTLiu2sGs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=r7MFKC2Q; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=RCYKGQ9C; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="r7MFKC2Q"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="RCYKGQ9C" Date: Thu, 21 May 2026 01:18:29 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1779326310; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R34Z622fBbihAf0SjdHye+h1ipt1Qoeqje1T5miNvyg=; b=r7MFKC2QMJB8UbwQx//NlvaG+SrnuWnpzLKNYuKSzs8/1nNUrCJzbDNEWWI56/JESCXVLj 9h91sxRjkqp+iM3NQ4WiDD1aj2VPFFm19UFeEJShY6Ilv4WEjB4zIvZreCxATYhxLFcq+P PzHL2Iik/QhMuoHhwqRGymPoyqhl+1mhNbwYt2a8WDKAAyIJ2FqlZs/MS03XnFiYtYGUOb uV5rxGNsLPBCeB8tNZ6ZXtYjdctx7YNpS+6YPJ2pkxW0Ogy0IKOEb1Yk6/4pb5+CsBFmNs zmMKHyeX+gAEzyz7WuFJIudfoB7+w22EpFkwB3FBpEemdKjf4AefgCnD6ZxPCA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1779326310; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R34Z622fBbihAf0SjdHye+h1ipt1Qoeqje1T5miNvyg=; b=RCYKGQ9CjzcmKvLQfUIIY7uf3wQtgqghOggxYnw8Co1n2uvjM7Q9H7C8XLqGURBytuNOQD gfKjEQBHVroEKIAg== From: tip-bot2 for Carlos =?utf-8?q?L=C3=B3pez?= Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/urgent] virt: sev-guest: Explicitly leak pages in unknown state Cc: clopez@suse.de, "Borislav Petkov (AMD)" , stable@kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <177932630902.711.9217620171097686703.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/urgent branch of tip: Commit-ID: fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf Gitweb: https://git.kernel.org/tip/fd948c3f96b18ff9ba7d3e8eae13d196593= e1aaf Author: Carlos L=C3=B3pez AuthorDate: Tue, 12 May 2026 12:00:42 +02:00 Committer: Borislav Petkov (AMD) CommitterDate: Wed, 20 May 2026 18:03:17 -07:00 virt: sev-guest: Explicitly leak pages in unknown state When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller. Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snp_leak_pages(). Fixes: 3e385c0d6ce8 ("virt: sev-guest: Move SNP Guest Request data pages hand= ling under snp_cmd_mutex") Signed-off-by: Carlos L=C3=B3pez Signed-off-by: Borislav Petkov (AMD) Cc: stable@kernel.org --- drivers/virt/coco/sev-guest/sev-guest.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-= guest/sev-guest.c index 910a1de..d186ae5 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -176,6 +176,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, = struct snp_guest_reques struct snp_guest_req req =3D {}; int ret, npages =3D 0, resp_len; sockptr_t certs_address; + u64 pfn; =20 if (sockptr_is_null(io->req_data) || sockptr_is_null(io->resp_data)) return -EINVAL; @@ -215,10 +216,11 @@ static int get_ext_report(struct snp_guest_dev *snp_dev= , struct snp_guest_reques if (!req.certs_data) return -ENOMEM; =20 + pfn =3D PHYS_PFN(virt_to_phys(req.certs_data)); ret =3D set_memory_decrypted((unsigned long)req.certs_data, npages); if (ret) { pr_err("failed to mark page shared, ret=3D%d\n", ret); - free_pages_exact(req.certs_data, npages << PAGE_SHIFT); + snp_leak_pages(pfn, npages); return -EFAULT; } =20 @@ -272,10 +274,12 @@ e_free: kfree(report_resp); e_free_data: if (npages) { - if (set_memory_encrypted((unsigned long)req.certs_data, npages)) + if (set_memory_encrypted((unsigned long)req.certs_data, npages)) { WARN_ONCE(ret, "failed to restore encryption mask (leak it)\n"); - else + snp_leak_pages(pfn, npages); + } else { free_pages_exact(req.certs_data, npages << PAGE_SHIFT); + } } return ret; }