[PATCH v4 1/3] KVM: Release memory-attribute reservations abandoned on ENOMEM

[David Ballesteros <davimaba.v@proton.me>]

kvm_vm_set_mem_attributes() reserves an xarray entry for every GFN in the
range before storing anything, so that the store phase cannot fail partway
through.  When a reservation fails, the loop jumps to out_unlock and the
reservations already made are abandoned: nothing in the call releases them.
A later request that clears a range covering them does erase them, as the
clear stores NULL over the reservation, but nothing obliges userspace to
issue one and a caller exploiting this will not; absent such a call the
entries live until kvm_destroy_vm().  An unprivileged user with /dev/kvm on
a VM with private-memory support can therefore leak kernel memory across
calls (a 576-byte xa_node per 64 GFNs) for the life of the VM fd.

The abandoned entries are not inert.  A bare reservation is an
XA_ZERO_ENTRY.  kvm_range_has_memory_attributes() is inconsistent about it:
the end == start + 1 path and the general loop treat it as absent (matching
kvm_get_memory_attributes(), which maps it to NULL via xa_load()), but the
!attrs fast path calls xas_find() directly, which returns the zero entry as
present.  Via hugepage_has_attrs(), that makes
kvm_arch_post_set_memory_attributes() mark a straddling head/tail hugepage
"mixed" for a range whose attributes are in fact uniform, so KVM stops
using a hugepage there until a later request re-covers it.

Release the reservations this call made on the failure path.  xa_release()
erases an entry only while it is still a reservation, so value entries that
predate this call are left untouched; it takes no gfp and cannot fail.
Only [start, i) is walked, i being the index whose reservation failed (no
entry was created at or beyond it).

Runtime-verified on v6.18.48 (isolated sw-protected VM, no KASAN, no fault
injection; the reservations are left behind by real memcg pressure via
clone(CLONE_VM), not by fault injection).  Unpatched, a failed request
retains on the order of 450000 xa_nodes (~250 MiB), and with one of them
inside a 2 MiB region a clear of the region's head page leaves pages_2m
unchanged (the reservation is invisible to xa_load), a clear of two pages
drops pages_2m by one and raises pages_4k by 512 (the hugepage is
degraded), and a clear covering the whole 2 MiB restores it.  With this
patch the same run retains under 2000 nodes -- three orders of magnitude
less, at the level of run-to-run noise -- and pages_2m stays at 16 across
all three clears: the reservations are released, so the hugepage is never
degraded.  Both arms used the same kernel config and the same test binary.
The bug reproduces with XA_FLAGS_ACCOUNT applied (patch 3/3), i.e.
accounting alone does not fix it.

Found by an AI-assisted security audit.

Fixes: 5a475554db1e ("KVM: Introduce per-page memory attributes")
Cc: stable@vger.kernel.org
Assisted-by: Claude-Code:claude-opus-5
Signed-off-by: David Ballesteros <davimaba.v@proton.me>
---
 virt/kvm/kvm_main.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2575,7 +2575,7 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
 	for (i = start; i < end; i++) {
 		r = xa_reserve(&kvm->mem_attr_array, i, GFP_KERNEL_ACCOUNT);
 		if (r)
-			goto out_unlock;
+			goto out_release;
 
 		cond_resched();
 	}
@@ -2594,6 +2594,28 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
 out_unlock:
 	mutex_unlock(&kvm->slots_lock);
 
+	return r;
+
+out_release:
+	/*
+	 * The reservation loop failed at @i; the entries in [start, i) were
+	 * reserved by this call and, without releasing them here, would be
+	 * retained until userspace happens to clear a range covering them, or
+	 * until the VM is destroyed.  The retained entries are not inert:
+	 * a bare reservation is an XA_ZERO_ENTRY, which the !attrs fast path of
+	 * kvm_range_has_memory_attributes() counts as present (it calls
+	 * xas_find() directly) even though kvm_get_memory_attributes() reports
+	 * it as absent, so a straddling hugepage over such an entry gets marked
+	 * mixed and KVM stops using a hugepage for a range whose attributes are
+	 * uniform.  xa_release() erases an entry only while it is still a
+	 * reservation, so value entries that predate this call are untouched.
+	 */
+	while (i-- > start) {
+		xa_release(&kvm->mem_attr_array, i);
+		cond_resched();
+	}
+	mutex_unlock(&kvm->slots_lock);
+
 	return r;
 }
 static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,