Re: [PATCH] KVM: Release reserved xarray entries if reserving memory attributes fails

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The error cleanup loop in `kvm_vm_set_mem_attributes` lacks a `cond_resched()` call, which can cause CPU soft lockups when reverting a massive memory range.
--

commit 628b8d791b455e8fdc196cf53b9e1f82e2d7fdb6
Author: Zeng Chi <zengchi@kylinos.cn>

KVM: Release reserved xarray entries if reserving memory attributes fails

This commit fixes a memory leak in kvm_vm_set_mem_attributes() where previously
reserved xarray entries were left behind if a subsequent reservation failed. It
adds a backward loop to release the successfully reserved entries before bailing
out on the error path.

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -2575,8 +2575,11 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
>  	 */
>  	for (i = start; i < end; i++) {
>  		r = xa_reserve(&kvm->mem_attr_array, i, GFP_KERNEL_ACCOUNT);
> -		if (r)
> +		if (r) {
> +			while (i-- > start)
> +				xa_release(&kvm->mem_attr_array, i);

[Severity: High]
Can this backward cleanup loop cause CPU soft lockups if a massive memory
range was requested?

The forward loop correctly yields the CPU via cond_resched() to handle large
ranges, but the unwinding error path does not. 

If userspace invokes KVM_SET_MEMORY_ATTRIBUTES on a massive range and
xa_reserve() eventually fails, this loop will continuously process potentially
millions of entries. On kernels with CONFIG_PREEMPT_VOLUNTARY or
CONFIG_PREEMPT_NONE, could this block scheduling long enough to trigger the
soft lockup watchdog?

>  			goto out_unlock;
> +		}
>  
>  		cond_resched();
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827110558.457891-1-zeng_chi911@163.com?part=1