Re: [PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[Jarkko Sakkinen <jarkko@kernel.org>]

On Fri, Aug 14, 2026 at 09:40:20PM +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
> 
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
> 
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  arch/x86/kernel/cpu/sgx/encl.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
> index 3f0222d10f6e6..04fbf7e703e1e 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.c
> +++ b/arch/x86/kernel/cpu/sgx/encl.c
> @@ -866,6 +866,7 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
>  
>  	ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
>  	if (ret) {
> +		kref_put(&encl->refcount, sgx_encl_release);
>  		kfree(encl_mm);
>  		return ret;
>  	}
> -- 
> 2.51.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko