From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-182.mta1.migadu.com (out-182.mta1.migadu.com [95.215.58.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36DF43655F7 for ; Mon, 1 Jun 2026 23:05:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780355112; cv=none; b=FrBmwEeoLhL/mQAMzQ3JZj/xRClvofF88iPGDDckMFAQICj21vDFLJr5VtJm1tp9cVKmfwZRV/1EX1aPSFo/OLzARBklJZ3VbGTJpfSvXkvy+ModZStbl6TgyerXdFN8G9beMaL4N9ybks3dVpQYGwbOY3VWgAnsL4nM8s7mOF4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780355112; c=relaxed/simple; bh=yBBNAHqeZj0yiEVQo2C2bFNBe2fJ1AMu/zDl1C0BFZE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=nfms75g8v6WpRUHXaTfFOtJNDfX5qOrUyoEGuJ3zP/560c3rD8vukSlHYiqjKRX4N5FSJAa03MmM+z6LSso6qMkmD6KChqr2lSNBWwbaws7pIRDTLGCGK62OholKGdctw6dXT+jubre3pFOT9jKMWIcXDdHKT03nNyTHkEErFQk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=pj91PvV1; arc=none smtp.client-ip=95.215.58.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="pj91PvV1" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1780355109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FD4N0HbKLWVq/NAJ+NnEjLSsyGj1uFnK4ULSwpaY3Y0=; b=pj91PvV1cVjFcCE77aVCey+4+FKCJdufWf/K6N24g9FsMXJY461BZaWWyvnEEJtjGcBP7J MWQ1EpYNd0i2PsMf37at8DVxErFArvg6gwqcaOXcPi2hQinJX6YBY9J+FSSXZKxbswD2h8 dwxqxCUs3rlJ9O6chgry5wRQaSVJzBA= From: Atish Patra Date: Mon, 01 Jun 2026 16:04:38 -0700 Subject: [PATCH v2 4/4] crypto: ccp: Fix memory leak in SEV INIT_EX path Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260601-sev_snp_fixes-v2-4-611891b28a86@meta.com> References: <20260601-sev_snp_fixes-v2-0-611891b28a86@meta.com> In-Reply-To: <20260601-sev_snp_fixes-v2-0-611891b28a86@meta.com> To: Sean Christopherson , Paolo Bonzini , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Tom Lendacky , Peter Gonda , Brijesh Singh , Youngjae Lee , Ashish Kalra , Michael Roth , John Allen , Herbert Xu Cc: clm@meta.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, stable@vger.kernel.org, Atish Patra , Sashiko X-Migadu-Flow: FLOW_OUT From: Atish Patra allocated pages in _init_ext_path are never freed and sev_init_ex_buffer is left pointing at the leaked memory in case of any failures during the function.. Fix by adding an error path that frees the pages and clears sev_init_ex_buffer. Make sure we only free the memory if the failure happens before the conversion. Otherwise, we may end up trying to free up converted pages in case of reclaim failure. rmp_mark_pages_firmware failures should be rare enough to avoid more code complexity to track down which pages were reclaimed/leaked vs which are not. Fixes: 7364a6fbca45 ("crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled") Reported-by: Sashiko Signed-off-by: Atish Patra --- drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 3d4793e8e34b..8566f164430b 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -1550,7 +1550,7 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev) rc = sev_read_init_ex_file(); if (rc) - return rc; + goto err_free; /* If SEV-SNP is initialized, transition to firmware page. */ if (sev->snp_initialized) { @@ -1559,11 +1559,23 @@ static int __sev_platform_init_handle_init_ex_path(struct sev_device *sev) npages = 1UL << get_order(NV_LENGTH); if (rmp_mark_pages_firmware(__pa(sev_init_ex_buffer), npages, true)) { dev_err(sev->dev, "SEV: INIT_EX NV memory page state change failed.\n"); - return -ENOMEM; + rc = -ENOMEM; + /* + * Don't free on conversion failure: the rollback may + * have left pages firmware-owned, and a high-order + * block can't be partially freed. + */ + goto err_reset; } } return 0; + +err_free: + __free_pages(page, get_order(NV_LENGTH)); +err_reset: + sev_init_ex_buffer = NULL; + return rc; } static int __sev_platform_init_locked(int *error) -- 2.53.0-Meta