Re: [PATCH v2] mshv: Don't free overlay pages after a failed unmap

[Wei Liu <wei.liu@kernel.org>]

On Sun, Nov 01, 2026 at 09:57:42PM -0500, Yuho Choi wrote:
> On L1VH partitions where the VMM can provide overlay GPFNs, the kernel
> allocates the VP state and stats pages and supplies them to the
> hypervisor as overlay locations through hv_map_vp_state_page() and
> hv_map_stats_page(). The hypervisor may write intercept messages,
> register state, and statistics to these pages. Only a successful
> HVCALL_UNMAP_VP_STATE_PAGE or HVCALL_UNMAP_STATS_PAGE confirms that the
> corresponding overlay has been revoked.
> 
> hv_unmap_vp_state_page() and hv_unmap_stats_page() free the overlay
> page regardless of the hypercall result. If the unmap fails, revocation
> is unconfirmed, but dropping the driver's page reference may still
> allow the page to be returned to the allocator and reused. A subsequent
> hypervisor write through a retained overlay could then corrupt an
> unrelated kernel or user allocation.
> 
> Free an overlay page only after the unmap hypercall succeeds. On failure,
> leak the page rather than return memory that the hypervisor may still be
> able to access. This matches how the rest of drivers/hv handles pages
> whose state is unknown after a failed hypervisor operation; for example,
> hv_free_page() leaks a page that could not be re-encrypted. Log the
> leaked page in both helpers, as some of their callers discard the
> return value.
> 
> Fixes: 19c515c27cee ("mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH")
> Fixes: d62313bdf596 ("mshv: Introduce new hypercall to map stats page for L1VH partitions")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>

Applied. Thanks.