From: "Huang, Kai" <kai.huang@intel.com>
To: "tglx@linutronix.de" <tglx@linutronix.de>,
"hpa@zytor.com" <hpa@zytor.com>,
"mingo@redhat.com" <mingo@redhat.com>,
"ruoyuw560@gmail.com" <ruoyuw560@gmail.com>,
"jarkko@kernel.org" <jarkko@kernel.org>,
"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>,
"bp@alien8.de" <bp@alien8.de>
Cc: "linux-sgx@vger.kernel.org" <linux-sgx@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"x86@kernel.org" <x86@kernel.org>
Subject: Re: [PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure
Date: Tue, 18 Aug 2026 11:27:57 +0000 [thread overview]
Message-ID: <327d1c155170de5bd6b1865850a00b26d7e1b3be.camel@intel.com> (raw)
In-Reply-To: <20260814134020.1386599-1-ruoyuw560@gmail.com>
On Fri, 2026-08-14 at 21:40 +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
>
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
>
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
next prev parent reply other threads:[~2026-08-18 11:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-14 13:40 Ruoyu Wang
2026-08-18 11:27 ` Huang, Kai [this message]
2026-08-20 12:30 ` Markus Elfring
2026-08-21 1:15 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=327d1c155170de5bd6b1865850a00b26d7e1b3be.camel@intel.com \
--to=kai.huang@intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=jarkko@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=ruoyuw560@gmail.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®