[PATCH v2] x86/sev: Fix kmemleak false positive for the RMP segment descriptors

[PATCH v2] x86/sev: Fix kmemleak false positive for the RMP segment descriptors

[Breno Leitao]

kmemleak reports the RMP segment descriptor as leaked on SEV-SNP hosts:

  unreferenced object 0xff11000140e23b40 (size 32):
    comm "swapper/0", pid 1, jiffies 4294680964
    hex dump (first 32 bytes):
      00 00 00 40 00 00 a0 ff 00 fc 05 04 00 00 00 00  ...@............
      00 c0 5f 40 00 00 00 00 00 00 00 00 00 00 00 00  .._@............
    backtrace (crc abf63fca):
      __kmalloc_cache_noprof+0x2e2/0x650
      alloc_rmp_segment_desc+0xdf/0x250
      setup_contiguous_rmptable+0xb0/0xd0
      setup_rmptable+0x13/0x60
      snp_rmptable_init+0x45/0xd0
      iommu_snp_enable+0x77/0xb0
      state_next+0x184/0xed0
      iommu_go_to_state+0x3a/0x90
      pci_iommu_init+0x32/0x50

The descriptor is still in use: get_raw_rmpentry() reads it on every RMP
lookup. Its only reference lives in rmp_segment_table[], and
alloc_rmp_segment_table() takes that table from the page allocator.
kmemleak does not scan page allocator memory, so it never sees the
reference and reports the descriptor as leaked.

Nothing requires the table to come from the page allocator, so allocate
it with kzalloc(). kmemleak tracks and scans slab objects, so it now
sees the descriptor pointers in the table.

Fixes: 0f14af0d1d7d ("x86/sev: Treat the contiguous RMP table as a single RMP segment")
Suggested-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Changes in v2:
- Allocate rmp_segment_table with kzalloc() instead of registering the
  page with kmemleak (Dave Hansen)
- Add the Fixes: and Suggested-by: tags
- Link to v1: https://patch.msgid.link/20261102-sev-rmp-kmemleak-v1-1-e6fb2eb96e79@debian.org
---
 arch/x86/virt/svm/sev.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
index bd70c4d0b774a3..18141c93b6d7c8 100644
--- a/arch/x86/virt/svm/sev.c
+++ b/arch/x86/virt/svm/sev.c
@@ -361,7 +361,7 @@ static void __init free_rmp_segment_table(void)
 		kfree(desc);
 	}
 
-	free_page((unsigned long)rmp_segment_table);
+	kfree(rmp_segment_table);
 
 	rmp_segment_table = NULL;
 }
@@ -369,14 +369,10 @@ static void __init free_rmp_segment_table(void)
 /* Allocate the table used to index into the RMP segments */
 static bool __init alloc_rmp_segment_table(void)
 {
-	struct page *page;
-
-	page = alloc_page(__GFP_ZERO);
-	if (!page)
+	rmp_segment_table = kzalloc(RST_SIZE, GFP_KERNEL);
+	if (!rmp_segment_table)
 		return false;
 
-	rmp_segment_table = page_address(page);
-
 	return true;
 }
 

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261102-sev-rmp-kmemleak-053969ac2126

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH v2] x86/sev: Fix kmemleak false positive for the RMP segment descriptors

[Dave Hansen]

On 11/3/26 06:01, Breno Leitao wrote:
> -	page = alloc_page(__GFP_ZERO);
> -	if (!page)
> +	rmp_segment_table = kzalloc(RST_SIZE, GFP_KERNEL);
> +	if (!rmp_segment_table)
>  		return false;

Hah, and that even made the code better because the old alloc_page()
wan't even connected to RST_SIZE. No checks anywhere.