From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB98AECAAD5 for ; Tue, 6 Sep 2022 14:35:55 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 540AA4BDDE; Tue, 6 Sep 2022 10:35:55 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Authentication-Results: mm01.cs.columbia.edu (amavisd-new); dkim=softfail (fail, message has been altered) header.i=@google.com Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7T0Vmz6Hi0IU; Tue, 6 Sep 2022 10:35:54 -0400 (EDT) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 34FC14BD69; Tue, 6 Sep 2022 10:35:54 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 10F674BD12 for ; Tue, 6 Sep 2022 10:35:53 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-lv7jNoxcGq for ; Tue, 6 Sep 2022 10:35:51 -0400 (EDT) Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id D23E84BBBA for ; Tue, 6 Sep 2022 10:35:51 -0400 (EDT) Received: by mail-ej1-f46.google.com with SMTP id fg1so1640676ejc.2 for ; Tue, 06 Sep 2022 07:35:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=p8gTx3uOF4/ovmXPFVRTuzyCMLlLLhT4cULIky1/IL8+iHMHN/Vt9kisTT0x13y5y6 1JrMubmWdS3RiAIdUBO3BzsfLe93IIXY2jVDIsDfOzVyq86Dk+K8V2v9nl1aYoEDOqzO v4BmSEkFlehCfvhThoWnOBq4wXZLuZG4tGqjgg3iQIBi2WhnLil3QOGlU+jcm0dvTxdb FBDNP3wkiukuDA9WlvUR289cSqbCdxmcqmidlmPrHl0GKV9BhrStliKQ0zbklVtzcvVg bW9RYHZlO/Ymx1i7ZL2HN7OGRdn6pV+RqJ6HLVkZg4niM2nbzxR7mHgCEEiZeD8UW7ET nBAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=hAspxQ7MclvhT7cyK6xHp2M7q+FRvYx6Y+OSlQLkJqaw4xsCV4JxHO8ssDMrM/a2gF UtSszNbeHIzX9ZPCnOS9Jopde5hCyjZrra93owr8QD3HLD/Ii4evxqITBHOB3Bj0SB/U cpcrxDzwTgeaWrWEEFo3tn6gI/cJVY/edEUJEeN48lIXv+x+b5xDFFjpLXfH3iqAyxBn QscxWw2451tG8HLHHzMYkDsaOGpdGmBrLGs4FolvZX91fNV3pWnM1wVmlnjhVV8RyVQ3 1eTR0emz7V4giXnucwQpebaVISCX/CpYcKTiew2zIPamO3v5mtNzn+xTwG8mlOzLfXS0 nYHA== X-Gm-Message-State: ACgBeo0GrKClGItvTG3qnFqyJvvUiNw4y/NKY6u9NtqdMEhSJTHxlbnb XNNF+XNqy0VqOKZ/XxQCe1u5Zg== X-Google-Smtp-Source: AA6agR5np46sPXKIJ6mj4xhD1w/LSNMP/pZ9ZrZilKDS7z6Q4hPFRehMAa3RPeEVWH2GeFCQf1WWwQ== X-Received: by 2002:a17:907:2cd4:b0:73c:9fa8:3ddc with SMTP id hg20-20020a1709072cd400b0073c9fa83ddcmr30463131ejc.40.1662474950709; Tue, 06 Sep 2022 07:35:50 -0700 (PDT) Received: from google.com (64.227.90.34.bc.googleusercontent.com. [34.90.227.64]) by smtp.gmail.com with ESMTPSA id h41-20020a0564020ea900b0044629b54b00sm8561495eda.46.2022.09.06.07.35.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Sep 2022 07:35:49 -0700 (PDT) Date: Tue, 6 Sep 2022 14:35:47 +0000 From: Quentin Perret To: Oliver Upton Subject: Re: [PATCH 02/14] KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make Message-ID: References: <20220830194132.962932-1-oliver.upton@linux.dev> <20220830194132.962932-3-oliver.upton@linux.dev> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220830194132.962932-3-oliver.upton@linux.dev> Cc: kvm@vger.kernel.org, Marc Zyngier , Ben Gardon , linux-kernel@vger.kernel.org, Catalin Marinas , David Matlack , Paolo Bonzini , Will Deacon , kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu Hi Oliver, On Tuesday 30 Aug 2022 at 19:41:20 (+0000), Oliver Upton wrote: > static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > kvm_pte_t *ptep, > struct stage2_map_data *data) > { > - if (data->anchor) > - return 0; > + struct kvm_pgtable_mm_ops *mm_ops = data->mm_ops; > + kvm_pte_t *childp = kvm_pte_follow(*ptep, mm_ops); > + struct kvm_pgtable *pgt = data->mmu->pgt; > + int ret; > > if (!stage2_leaf_mapping_allowed(addr, end, level, data)) > return 0; > > - data->childp = kvm_pte_follow(*ptep, data->mm_ops); > kvm_clear_pte(ptep); > > /* > @@ -782,8 +786,13 @@ static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > * individually. > */ > kvm_call_hyp(__kvm_tlb_flush_vmid, data->mmu); > - data->anchor = ptep; > - return 0; > + > + ret = stage2_map_walk_leaf(addr, end, level, ptep, data); > + > + mm_ops->put_page(ptep); > + mm_ops->free_removed_table(childp, level + 1, pgt); By the look of it, __kvm_pgtable_visit() has saved the table PTE on the stack prior to calling the TABLE_PRE callback, and it then uses the PTE from its stack and does kvm_pte_follow() to find the childp, and walks from there. Would that be a UAF now? > + return ret; > } _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B6C9FC6FA83 for ; Tue, 6 Sep 2022 15:26:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Aj8yEjuaGLHXkhPUkSOiUYKb4+VADJoZHY7NvflE9ek=; b=K3ORmIOa1kj0Hy sPGBRXp94zSxSOm0slk9RxVjm74T2Lj98mKdvVBCOGvHMKna8PChUXIaBjB9USNxeYamlHNtFfYtj STjLMxqxQ8G8TKYs0t9rsdnmfvTf3+2Pn0CYvxoeKib0TiipRscrp3Qu8C5pmEfONaztw4+ACG1aC UhE6GUknSiO4MYUQNqSj4r7tMpUpPGM+k9pjFZFgbqS9+2De1jI68NGqj9VCXkBKD8hXgFpEerj43 aHy7/L9cYMjkq61OtVCqiL01uzzAwLI56MM0kRuhdGaSfbn3hoRQ2dsr+Z9pDrWh+/D1Y2pKSBNaL r7EQkm7MEX1v2LhCjpqQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oVaRd-00ElTB-0W; Tue, 06 Sep 2022 15:24:59 +0000 Received: from mail-ej1-x632.google.com ([2a00:1450:4864:20::632]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oVZgE-00EMRi-ID for linux-arm-kernel@lists.infradead.org; Tue, 06 Sep 2022 14:36:00 +0000 Received: by mail-ej1-x632.google.com with SMTP id lz22so2915345ejb.3 for ; Tue, 06 Sep 2022 07:35:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=p8gTx3uOF4/ovmXPFVRTuzyCMLlLLhT4cULIky1/IL8+iHMHN/Vt9kisTT0x13y5y6 1JrMubmWdS3RiAIdUBO3BzsfLe93IIXY2jVDIsDfOzVyq86Dk+K8V2v9nl1aYoEDOqzO v4BmSEkFlehCfvhThoWnOBq4wXZLuZG4tGqjgg3iQIBi2WhnLil3QOGlU+jcm0dvTxdb FBDNP3wkiukuDA9WlvUR289cSqbCdxmcqmidlmPrHl0GKV9BhrStliKQ0zbklVtzcvVg bW9RYHZlO/Ymx1i7ZL2HN7OGRdn6pV+RqJ6HLVkZg4niM2nbzxR7mHgCEEiZeD8UW7ET nBAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=mu0jIK56UQXOc9/CQ2EuIssqR/euKQhgOwfK5rXvNV/523Bh/pja4+udfgdkIV/zbf YaGEokJCD80dIPKEWq+EfEvdo1elCD3cLGMeQB6xB07Q/zFkSFU0D+0phBP4b7C7f2Fp WnfSka+0zDF9eS3Ck1eNjpd4X2yaT9ChEzkEllTnTA18MWNA0Tz22LxPpx9vr34DOV3g NMApcd1FgOOy5yWP8HJ+2YY+g0hTWy4RBgiFF4ar8aI45KBscKh6/ZGTJVTEgHeBGjLX 9AShoz3vyrbz79JYnOv+MNBZ35+v8MRsa3n/ftxOlhPCWwNlw+hgtDZnI5xBVG1hW+/g FTEQ== X-Gm-Message-State: ACgBeo2Hn73FdC2iD3IB9voiWxTla3sr+bqIUF9By4N+eNEmBGAHvpPt xVXTHTkAZK5VfJf2KfOKMYlTvA== X-Google-Smtp-Source: AA6agR5np46sPXKIJ6mj4xhD1w/LSNMP/pZ9ZrZilKDS7z6Q4hPFRehMAa3RPeEVWH2GeFCQf1WWwQ== X-Received: by 2002:a17:907:2cd4:b0:73c:9fa8:3ddc with SMTP id hg20-20020a1709072cd400b0073c9fa83ddcmr30463131ejc.40.1662474950709; Tue, 06 Sep 2022 07:35:50 -0700 (PDT) Received: from google.com (64.227.90.34.bc.googleusercontent.com. [34.90.227.64]) by smtp.gmail.com with ESMTPSA id h41-20020a0564020ea900b0044629b54b00sm8561495eda.46.2022.09.06.07.35.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Sep 2022 07:35:49 -0700 (PDT) Date: Tue, 6 Sep 2022 14:35:47 +0000 From: Quentin Perret To: Oliver Upton Cc: Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , Catalin Marinas , Will Deacon , Ricardo Koller , Reiji Watanabe , David Matlack , Ben Gardon , Paolo Bonzini , Gavin Shan , Peter Xu , Sean Christopherson , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 02/14] KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make Message-ID: References: <20220830194132.962932-1-oliver.upton@linux.dev> <20220830194132.962932-3-oliver.upton@linux.dev> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220830194132.962932-3-oliver.upton@linux.dev> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220906_073558_657999_E01629DE X-CRM114-Status: GOOD ( 13.75 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Oliver, On Tuesday 30 Aug 2022 at 19:41:20 (+0000), Oliver Upton wrote: > static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > kvm_pte_t *ptep, > struct stage2_map_data *data) > { > - if (data->anchor) > - return 0; > + struct kvm_pgtable_mm_ops *mm_ops = data->mm_ops; > + kvm_pte_t *childp = kvm_pte_follow(*ptep, mm_ops); > + struct kvm_pgtable *pgt = data->mmu->pgt; > + int ret; > > if (!stage2_leaf_mapping_allowed(addr, end, level, data)) > return 0; > > - data->childp = kvm_pte_follow(*ptep, data->mm_ops); > kvm_clear_pte(ptep); > > /* > @@ -782,8 +786,13 @@ static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > * individually. > */ > kvm_call_hyp(__kvm_tlb_flush_vmid, data->mmu); > - data->anchor = ptep; > - return 0; > + > + ret = stage2_map_walk_leaf(addr, end, level, ptep, data); > + > + mm_ops->put_page(ptep); > + mm_ops->free_removed_table(childp, level + 1, pgt); By the look of it, __kvm_pgtable_visit() has saved the table PTE on the stack prior to calling the TABLE_PRE callback, and it then uses the PTE from its stack and does kvm_pte_follow() to find the childp, and walks from there. Would that be a UAF now? > + return ret; > } _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AAB2ECAAD5 for ; Tue, 6 Sep 2022 15:25:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237767AbiIFPZH (ORCPT ); Tue, 6 Sep 2022 11:25:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233941AbiIFPYg (ORCPT ); Tue, 6 Sep 2022 11:24:36 -0400 Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E664BD4CB for ; Tue, 6 Sep 2022 07:36:18 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id u9so23772555ejy.5 for ; Tue, 06 Sep 2022 07:36:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=p8gTx3uOF4/ovmXPFVRTuzyCMLlLLhT4cULIky1/IL8+iHMHN/Vt9kisTT0x13y5y6 1JrMubmWdS3RiAIdUBO3BzsfLe93IIXY2jVDIsDfOzVyq86Dk+K8V2v9nl1aYoEDOqzO v4BmSEkFlehCfvhThoWnOBq4wXZLuZG4tGqjgg3iQIBi2WhnLil3QOGlU+jcm0dvTxdb FBDNP3wkiukuDA9WlvUR289cSqbCdxmcqmidlmPrHl0GKV9BhrStliKQ0zbklVtzcvVg bW9RYHZlO/Ymx1i7ZL2HN7OGRdn6pV+RqJ6HLVkZg4niM2nbzxR7mHgCEEiZeD8UW7ET nBAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date; bh=rMmt2TPlkwTJa1Vj/UqXw4OPfF6SV2ruzHSSjtSG6gI=; b=gLhtYEQHzgXxk54az96X8XSWfGFEbs2ykE3rsKcKZS0jZ4dZLAFlL/V1LX22Hret0j 5b11bsV5qxgVt+R/eBzMsQCcJeDtHxsgO42eIm6KGTKa743KXUC7+DNyXiQckdQ0IctS uZAmIg6i2G/pEw3xBE8O7ZymtRkdcAoHDbq7zw8DUJh/5Nu+IqRq/dTbr3Dm4CvV1t7u HunwBf0tcdDOdBXMo7L00I/h8yDdRa/GR9aHF9D3dz8M2L+0dt0Mddzn9oIwCX9cU31q GMdl841OxrdcCzhfm18yKfcudWcyE32bX4cDo4h2Ea/tcEb4klzrPAMwH8TVePkTSyTm tlTA== X-Gm-Message-State: ACgBeo2XSXoYtU7GcorJec9XebtTXPZy46mLK0QlyaJxPqmzhAhswRt9 GO/MO5ifXEmsc0OtHXPRnEcVnA== X-Google-Smtp-Source: AA6agR5np46sPXKIJ6mj4xhD1w/LSNMP/pZ9ZrZilKDS7z6Q4hPFRehMAa3RPeEVWH2GeFCQf1WWwQ== X-Received: by 2002:a17:907:2cd4:b0:73c:9fa8:3ddc with SMTP id hg20-20020a1709072cd400b0073c9fa83ddcmr30463131ejc.40.1662474950709; Tue, 06 Sep 2022 07:35:50 -0700 (PDT) Received: from google.com (64.227.90.34.bc.googleusercontent.com. [34.90.227.64]) by smtp.gmail.com with ESMTPSA id h41-20020a0564020ea900b0044629b54b00sm8561495eda.46.2022.09.06.07.35.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Sep 2022 07:35:49 -0700 (PDT) Date: Tue, 6 Sep 2022 14:35:47 +0000 From: Quentin Perret To: Oliver Upton Cc: Marc Zyngier , James Morse , Alexandru Elisei , Suzuki K Poulose , Catalin Marinas , Will Deacon , Ricardo Koller , Reiji Watanabe , David Matlack , Ben Gardon , Paolo Bonzini , Gavin Shan , Peter Xu , Sean Christopherson , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 02/14] KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make Message-ID: References: <20220830194132.962932-1-oliver.upton@linux.dev> <20220830194132.962932-3-oliver.upton@linux.dev> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220830194132.962932-3-oliver.upton@linux.dev> Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Hi Oliver, On Tuesday 30 Aug 2022 at 19:41:20 (+0000), Oliver Upton wrote: > static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > kvm_pte_t *ptep, > struct stage2_map_data *data) > { > - if (data->anchor) > - return 0; > + struct kvm_pgtable_mm_ops *mm_ops = data->mm_ops; > + kvm_pte_t *childp = kvm_pte_follow(*ptep, mm_ops); > + struct kvm_pgtable *pgt = data->mmu->pgt; > + int ret; > > if (!stage2_leaf_mapping_allowed(addr, end, level, data)) > return 0; > > - data->childp = kvm_pte_follow(*ptep, data->mm_ops); > kvm_clear_pte(ptep); > > /* > @@ -782,8 +786,13 @@ static int stage2_map_walk_table_pre(u64 addr, u64 end, u32 level, > * individually. > */ > kvm_call_hyp(__kvm_tlb_flush_vmid, data->mmu); > - data->anchor = ptep; > - return 0; > + > + ret = stage2_map_walk_leaf(addr, end, level, ptep, data); > + > + mm_ops->put_page(ptep); > + mm_ops->free_removed_table(childp, level + 1, pgt); By the look of it, __kvm_pgtable_visit() has saved the table PTE on the stack prior to calling the TABLE_PRE callback, and it then uses the PTE from its stack and does kvm_pte_follow() to find the childp, and walks from there. Would that be a UAF now? > + return ret; > }