From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFEE13F4116 for ; Fri, 26 Jun 2026 11:26:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473208; cv=none; b=eFmRkmRxuj56mhoF24ztANlVBNpV6OMueoDhwgWaACz+/5mDnn/NXgScChJexTgZ9NdQ+Ai0ms9s4Xk2VcTSL409XMyNMBrhX1yaPpKhe8yyUNeN82YUsQUp5Z/ERurW5EjDLyO10pj3/BLx2TiZxVOruvedjlOlr25NjA9sNa4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782473208; c=relaxed/simple; bh=U9xiOlPCxsFxaHbarkNuBhgU8OAUHm2+VUszRCkRVlI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mv/qPgjj5CnZWzmpmnRsClfOd8D9Y83zWgA5QraOCaE272Rz6etVzJHuQjsje0D9xaR4xdppfrXHGcqXs8kVUWTEMs6mIcCSCfVmakHWZfFYiWIzBHEvsPEAI4ilwOxCsK+R1nvhYsdjoKv/jwL6QN0xslVHSttEoCYoPEKJX/I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Uy5mcC5U; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=uJD8J1kD; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Uy5mcC5U"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="uJD8J1kD" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782473204; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Bupm+7QjQV9vS8enNO4YwYZYh4Q3etkrvUknwmj0KyM=; b=Uy5mcC5UYLGGvcKTjuQRWzF375D14r/7Gq7tLGtbYBM2gSjho4AUhPq4GAY9LWTwmkJZRv /R8s49OZhRhRoMEn4VQ1jlHs6E7AGzfmF9Fcg4sfbg3bI+0suyTWK6uaN2g2DuuesffuzG c7XthReTlfaKvAB3+zZNRR8y3RxNvS0= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-670-_4iYGeFoMpq2u6u-3uJZPA-1; Fri, 26 Jun 2026 07:26:42 -0400 X-MC-Unique: _4iYGeFoMpq2u6u-3uJZPA-1 X-Mimecast-MFC-AGG-ID: _4iYGeFoMpq2u6u-3uJZPA_1782473201 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-490b7959b9fso6846005e9.2 for ; Fri, 26 Jun 2026 04:26:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1782473201; x=1783078001; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Bupm+7QjQV9vS8enNO4YwYZYh4Q3etkrvUknwmj0KyM=; b=uJD8J1kD8PA7S303ieTceDIOo2RhIVqEARUriqRyCPKKmZyzhnRVLz3Y3WYBPzm8gT jHxhkqbSFLtI0XCPFBdVwI707wTKwNiyAU7mn3NCUhAtciMzLO6SDrwYuVxbBr+jXhRk 5Vrb0GHwNr17xwHlocfBRGY57gbGSAKUFYGY1ZYCQ4IrhtfgUHR8/KoACRn2bk4f9GAr 5BWTTCKK+Jstd0LAr0IXGUpUlFReWygazIgYMcHgtl6WIOvvSWu+TlMPdV0eD0clwdQM c4BW8fWjP+joTgPvolJESJDNcNie56X2fACUi21hLptt9WNg9+ZyCEq3+zghPCDB5r+l d7OQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782473201; x=1783078001; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Bupm+7QjQV9vS8enNO4YwYZYh4Q3etkrvUknwmj0KyM=; b=FoeCIukK+jMXKGkeFKL/f9HhiVQEs7xcyZd3e5xvLr3K8xxAhjE0YgaU9QSDVSz7w+ EqWJ+qQJfLixPbAPurzkHb2PHCpPFgGWyYrHCZ54p5AbTlo73DEDC7hFTp6lP9aKHDTW WyYkei0UA5Jff9q6JnX0SyQBf8rPu9jXR9C/eSmDXzdrfV9UPwOyGErPcFtGdxGM7Lei l1aRWnj269EBimyhGNoF3qHS7qg/LO2tdew2l+TzYBzUgrX4QW4xlG0cRxUAZu+9SDPA I9vt6qk8lkqtoFQrptH5Y5D+EI1tdVgd7S/tSJqpH1iTr+KPXxnhmSscIjRe1n+kMokJ 9uUQ== X-Gm-Message-State: AOJu0Yw/DL70rLNcNfrr1XyTF6Oh6BL3U+AYWBSxo0Gj5N98mMW2RBPJ o0PWmKg4DQgE0cCfznyQ5XkWBttXaSuBQFq+c4B3WSrUEy20cujZNdJYiss3uPWMXu73OZ6w7cZ hj4aB88oXIIb7IyTYOpA0yhw7PAkvC7FiAUXZ5qwhaBjnnyLYBYigJggPZJ0viUwtrC8lYdHyoY 9pmkXV8MH+Atq9PFgSvqYaRpAdcazKEg+rMlrRSoWABXlQn0R4AQ== X-Gm-Gg: AfdE7cknzuD01tAGF4tN3VFwYdF3zMgF3rIEWIQmlpIE8dEgL9G3XSrmZyuIjNEyt39 aqm3LgzSfdErgvEA5SNEaKMvO6hW/80m3tCoqK+ILY+VoLkuuUDbrXSr8abEETdYwGmMAkGA8o4 PqYTSAe+OiQdYSsfxdLyWkpWvHL2lgBLQSVXUfvisBuiowYx9dPJ0SxDm280rrVjsG2A4ZDWMyS muhVN141Yg8O5K1O1q6aJ3MknLhSfbXpdH11kCwmG4roRh/oTsbaOgMXHIw+pWVy78OuFZ7MELe Ony9WDoZa/sPpZbIl02urH3RpRBC3tehf3q/Ky3MFJW/YXivYnMqQF9GMBwFtm38IscvLdxqi58 qhuO1gQ78Y4xvvLnCnY6NksMJkiAJrR4qHwHeIMXjL+D+R3kTr5EodGWP0PWK8Qfo5/DzRTDZbz lSApsmllOXxeXHpnGV X-Received: by 2002:a05:600d:644a:20b0:490:a298:acf7 with SMTP id 5b1f17b1804b1-49266899f6dmr72107815e9.17.1782473200940; Fri, 26 Jun 2026 04:26:40 -0700 (PDT) X-Received: by 2002:a05:600d:644a:20b0:490:a298:acf7 with SMTP id 5b1f17b1804b1-49266899f6dmr72107295e9.17.1782473200328; Fri, 26 Jun 2026 04:26:40 -0700 (PDT) Received: from [192.168.10.48] ([151.95.124.208]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-492691f60bcsm74298495e9.1.2026.06.26.04.26.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 04:26:38 -0700 (PDT) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org Cc: Sean Christopherson Subject: [PATCH 5.10.y 02/17] KVM: x86/mmu: Allocate the lm_root before allocating PAE roots Date: Fri, 26 Jun 2026 13:26:19 +0200 Message-ID: <20260626112634.1778506-3-pbonzini@redhat.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260626112634.1778506-1-pbonzini@redhat.com> References: <20260626112634.1778506-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sean Christopherson commit ba0a194ffbfb4168a277fb2116e8362013e2078f upstream. Allocate lm_root before the PAE roots so that the PAE roots aren't leaked if the memory allocation for the lm_root happens to fail. Note, KVM can still leak PAE roots if mmu_check_root() fails on a guest's PDPTR, or if mmu_alloc_root() fails due to MMU pages not being available. Those issues will be fixed in future commits. Signed-off-by: Sean Christopherson Message-Id: <20210305011101.3597423-5-seanjc@google.com> Signed-off-by: Paolo Bonzini --- arch/x86/kvm/mmu/mmu.c | 64 ++++++++++++++++++++---------------------- 1 file changed, 31 insertions(+), 33 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c2c76419af0c..508acf26e30c 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -3307,21 +3307,38 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) * the shadow page table may be a PAE or a long mode page table. */ pm_mask = PT_PRESENT_MASK; - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { + if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) pm_mask |= PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; - /* - * Allocate the page for the PDPTEs when shadowing 32-bit NPT - * with 64-bit only when needed. Unlike 32-bit NPT, it doesn't - * need to be in low mem. See also lm_root below. - */ - if (!mmu->pae_root) { - WARN_ON_ONCE(!tdp_enabled); + /* + * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP + * tables are allocated and initialized at root creation as there is no + * equivalent level in the guest's NPT to shadow. Allocate the tables + * on demand, as running a 32-bit L1 VMM is very rare. Unlike 32-bit + * NPT, the PDP table doesn't need to be in low mem. Preallocate the + * pages so that the PAE roots aren't leaked on failure. + */ + if (mmu->shadow_root_level == PT64_ROOT_4LEVEL && + (!mmu->pae_root || !mmu->lm_root)) { + u64 *lm_root, *pae_root; - mmu->pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); - if (!mmu->pae_root) - return -ENOMEM; + if (WARN_ON_ONCE(!tdp_enabled || mmu->pae_root || mmu->lm_root)) + return -EIO; + + pae_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); + if (!pae_root) + return -ENOMEM; + + lm_root = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT); + if (!lm_root) { + free_page((unsigned long)pae_root); + return -ENOMEM; } + + mmu->pae_root = pae_root; + mmu->lm_root = lm_root; + + lm_root[0] = __pa(mmu->pae_root) | pm_mask; } for (i = 0; i < 4; ++i) { @@ -3343,30 +3360,11 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu) return -ENOSPC; mmu->pae_root[i] = root | pm_mask; } - mmu->root_hpa = __pa(mmu->pae_root); - - /* - * When shadowing 32-bit or PAE NPT with 64-bit NPT, the PML4 and PDP - * tables are allocated and initialized at MMU creation as there is no - * equivalent level in the guest's NPT to shadow. Allocate the tables - * on demand, as running a 32-bit L1 VMM is very rare. The PDP is - * handled above (to share logic with PAE), deal with the PML4 here. - */ - if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) { - if (mmu->lm_root == NULL) { - u64 *lm_root; - - lm_root = (void*)get_zeroed_page(GFP_KERNEL_ACCOUNT); - if (!lm_root) - return -ENOMEM; - - lm_root[0] = __pa(mmu->pae_root) | pm_mask; - - mmu->lm_root = lm_root; - } + if (mmu->shadow_root_level == PT64_ROOT_4LEVEL) mmu->root_hpa = __pa(mmu->lm_root); - } + else + mmu->root_hpa = __pa(mmu->pae_root); set_root_pgd: mmu->root_pgd = root_pgd; -- 2.54.0