[PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[Ruoyu Wang]

Each sgx_encl_mm instance holds an enclave reference so the enclave
outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
before calling __mmu_notifier_register().

Notifier registration can fail while allocating subscription state or
when mm_take_all_locks() is interrupted. In that case no notifier or
mm_list entry takes ownership of encl_mm. The error path frees encl_mm
but leaves the enclave reference behind, preventing the enclave and its
resources from being released.

Drop the enclave reference before freeing the unpublished encl_mm. This
balances the acquisition without changing the successful registration
and teardown paths.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 arch/x86/kernel/cpu/sgx/encl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index 3f0222d10f6e6..04fbf7e703e1e 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -866,6 +866,7 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
 
 	ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
 	if (ret) {
+		kref_put(&encl->refcount, sgx_encl_release);
 		kfree(encl_mm);
 		return ret;
 	}
-- 
2.51.0

Re: [PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[Huang, Kai]

On Fri, 2026-08-14 at 21:40 +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
> 
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
> 
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>

Reviewed-by: Kai Huang <kai.huang@intel.com>

Re: [PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[Markus Elfring]

…
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
…

How do you think about to increase the application of scope-based resource management
also for an improved implementation of a function like sgx_encl_mm_add()?

Regards,
Markus

Re: [PATCH] x86/sgx: Drop enclave reference on MMU notifier registration failure

[Jarkko Sakkinen]

On Fri, Aug 14, 2026 at 09:40:20PM +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
> 
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
> 
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list entry")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  arch/x86/kernel/cpu/sgx/encl.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
> index 3f0222d10f6e6..04fbf7e703e1e 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.c
> +++ b/arch/x86/kernel/cpu/sgx/encl.c
> @@ -866,6 +866,7 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
>  
>  	ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
>  	if (ret) {
> +		kref_put(&encl->refcount, sgx_encl_release);
>  		kfree(encl_mm);
>  		return ret;
>  	}
> -- 
> 2.51.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko