From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591086; b=nQB4Oxe3VHGV1uf3agcCuFKDHzhO6qzivJSD7voJnVsOmHqPfPj0CNZ9gCyQ5urnu1R1 ky5QjBrwZs4bcFk/Owj6zO1hDmosr8BIFWaan62/aLURr1WHEptKptUlMCCXRPtT6Nrwl XNI3xayeb+2uSih0wpzdPMLmMa6PHix0DnFyyr7yqb4T3cnBSJB4jXQcTANbz2sNieSvq E8Of+qWMphvJ3oJbyaafXXySBiMJ3B0KcZHi/B3+YiHBg3+nSJMxeamvFeRgsbhAefif8 nQcHS+mNlTZYoMGXc9Z4kbkvvILM9+3R7/a/GplbtXvkoeDdJLX6JrzCxWnQUzRCRng== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591086; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=faMDVdYa7ATGapTHrMTrDVyzwPY4neQNTOJ+uqEAjko=; b=IQL8E2Qlg99vItFgH89wgtKeW3SC6oWv6J/aP8YBLuol6VjK80I6+E0OJobYk7wVgtoV RTnf8OZLYa44hfWhYAXiVzVEQaAOehUocYlLer2uPrMTN+jJHZraDz78Wgd6lR17oL4xt SALAnLcw1nB7vetw94ld2bd3We4No+9v9xH86G0Lxos+nMLkf6RLoinEzekY4Mp6erHu6 FxzlicUvsAyRSTYF173mldrEkVrLhlOUw2qXWRDs9KZ3zFGLH2RpchHjUuAzBQMargkOr dLii3rit+31hS4K5fq3TGUNUaoC5pFthYr/bl+IhKgTgsAxMAWGEu8HAPfX4dGXWBrg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=mjHrqufR; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C67A6073227; Fri, 13 Nov 2026 17:31:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=mjHrqufR Received: by smtp.kernel.org (Postfix) with ESMTPSA id 289C71F000C6; Fri, 13 Nov 2026 17:31:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591086; bh=faMDVdYa7ATGapTHrMTrDVyzwPY4neQNTOJ+uqEAjko=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mjHrqufRi5aOIACRdzcPXKG5D6Jcb3iSD9i48iMhf61ZPiCUs/35A/B2/t2MJUs/l uHGKNH/N4P0nMMzT842CL/FZiKvd5T1JtEEXappGKeYCzhRbU7RBbWbTZzirB4ovAM 0T3CWeKzkiNR75CSu9I74OTpYY+srRbL7mX52n8g= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tal Zussman , Linfeng Sun , "Michael S. Tsirkin" , Sasha Levin Subject: [PATCH 6.12 240/670] vhost-vdpa: fix pinned page leak in vhost_vdpa_pa_map() error path Date: Fri, 13 Nov 2026 10:46:44 -0500 Message-ID: <20261113153819.982784518@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tal Zussman [ Upstream commit fd1462c96bafe2cb14e88c837b270f8990b717b5 ] When pin_user_pages() or vhost_vdpa_map() fails, vhost_vdpa_pa_map() is supposed to unpin the pages pinned after the last successfully mapped chunk, i.e. the range [map_pfn, last_pfn]. The unpin is guarded by nchunks, but nchunks is reset to 0 every time a chunk is mapped from inside the current page list, so a failure after any such boundary leaves that pending range pinned forever. With physically scattered memory nearly every page list contains a boundary, so the leak happens on practically every failed IOTLB update. The pending range is non-empty exactly when a page has been pinned, which last_pfn already tells us, so drop nchunks and test last_pfn. Fixes: ad89653f79f1 ("vhost-vdpa: fix page pinning leakage in error path (rework)") Cc: stable@vger.kernel.org Signed-off-by: Tal Zussman Reported-by: Linfeng Sun Signed-off-by: Michael S. Tsirkin Message-ID: <20261031-vhost-vdpa-unpin-v1-1-94ffc9683256@columbia.edu> Signed-off-by: Sasha Levin --- drivers/vhost/vdpa.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index a940718745def..33e3100b3836d 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -1151,7 +1151,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, unsigned long list_size = PAGE_SIZE / sizeof(struct page *); unsigned int gup_flags = FOLL_LONGTERM; unsigned long npages, cur_base, map_pfn, last_pfn = 0; - unsigned long lock_limit, sz2pin, nchunks, i; + unsigned long lock_limit, sz2pin, i; unsigned long page_offset; u64 start = iova; long pinned; @@ -1187,7 +1187,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, cur_base = uaddr & PAGE_MASK; iova &= PAGE_MASK; - nchunks = 0; while (npages) { sz2pin = min_t(unsigned long, npages, list_size); @@ -1202,7 +1201,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, } goto out; } - nchunks++; if (!last_pfn) map_pfn = page_to_pfn(page_list[0]); @@ -1233,7 +1231,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, map_pfn = this_pfn; iova += csize; - nchunks = 0; } last_pfn = this_pfn; @@ -1248,7 +1245,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, PFN_PHYS(map_pfn), perm, NULL); out: if (ret) { - if (nchunks) { + if (last_pfn) { unsigned long pfn; /* @@ -1260,7 +1257,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, * the corresponding unpinning will be handled by * vdpa_unmap(). */ - WARN_ON(!last_pfn); for (pfn = map_pfn; pfn <= last_pfn; pfn++) unpin_user_page(pfn_to_page(pfn)); } -- 2.53.0