From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590276; b=Tv5/5UVey0JDzyZGB+RxPX4CtobICENmE8wJa4e13kaatMCJqwzIv9+6Aa5+dpEuQloD XMtYomyG6KANEz3wYB3Hc7TGimaoNRvXqQ2+6MwTUpfKvB4TTTzUbimBsN0bWigrqXol/ sbWBP5rbejyr+3GDq/UFX1K7L5rOEVGgtSPeVXYmVy1+K2+IdDubv/f4rF94kmCXhrAth hGxqwQHfUzWGA/CTzyqD3KSv0lsoZ1insG6Oic6XF85qESI40Am1Y3Q4Y2/oKZJp9Ucx6 tz2GZp5SjD0BdSRCaMxj1lN80a0ItDaHKcr2QIsTh8VLP0tnLbA4oX22acui8007fhw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590276; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=kjsMAlz2FqLEkzNhkxU2fzV7rxZasdZEYRld/63qQQg=; b=Fv/ihMvxHxJ40CTYdi5dNt4w4G3pDZWuVO0PQc8FBh7I2flmEm/nWCVK9B8gks1JauvO 9Zk3kG2fl40SUWNzJuvoVfmClaRSQtFw4bRPG05j0gqrKW9xqYkIOZVbrkoZ+GaTwfNvF iWLotXhJ96qbik9aPbfSg/fkPsaPHKsvI/c3WmDuQDfuGdehKU4OQ7fqi9orFWVE+l8Xf ORea7w553UwGgO3yrCD9asl1BPLjHw7tirWAURtVljZeKLi/6t680wQZ8Jk6PgCf6cD8U kOVteymQqBmjKAux2warnncTyiIZ0OBudT5n0vW+Ux14PjcGYtsTRcqgdeBgHd+oS/w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="bUA57/NN"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7508C60776CE; Fri, 13 Nov 2026 17:17:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bUA57/NN Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2178A1F000C4; Fri, 13 Nov 2026 17:17:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590276; bh=kjsMAlz2FqLEkzNhkxU2fzV7rxZasdZEYRld/63qQQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bUA57/NNHIELvoL0fM0aeQkoJAq0rkT+rDDBNS78rYlwwPojW5V5ecyaNhPNa5PV2 Hb8+nv1tcOpUWWOXrhkNNaXtazt8sggLybNDq/cNdZ5+XoELu9NCZpAEg5B7T1jm9p 660Nu/sYDMWCIEMTA9++UysvN0rOpBu+6wiFsWC8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tal Zussman , Linfeng Sun , "Michael S. Tsirkin" , Sasha Levin Subject: [PATCH 6.18 266/686] vhost-vdpa: fix pinned page leak in vhost_vdpa_pa_map() error path Date: Fri, 13 Nov 2026 10:46:39 -0500 Message-ID: <20261113153830.038148244@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tal Zussman [ Upstream commit fd1462c96bafe2cb14e88c837b270f8990b717b5 ] When pin_user_pages() or vhost_vdpa_map() fails, vhost_vdpa_pa_map() is supposed to unpin the pages pinned after the last successfully mapped chunk, i.e. the range [map_pfn, last_pfn]. The unpin is guarded by nchunks, but nchunks is reset to 0 every time a chunk is mapped from inside the current page list, so a failure after any such boundary leaves that pending range pinned forever. With physically scattered memory nearly every page list contains a boundary, so the leak happens on practically every failed IOTLB update. The pending range is non-empty exactly when a page has been pinned, which last_pfn already tells us, so drop nchunks and test last_pfn. Fixes: ad89653f79f1 ("vhost-vdpa: fix page pinning leakage in error path (rework)") Cc: stable@vger.kernel.org Signed-off-by: Tal Zussman Reported-by: Linfeng Sun Signed-off-by: Michael S. Tsirkin Message-ID: <20261031-vhost-vdpa-unpin-v1-1-94ffc9683256@columbia.edu> Signed-off-by: Sasha Levin --- drivers/vhost/vdpa.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index 219af4f0d06a8..e4ddaf0e5abc6 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -1149,7 +1149,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, unsigned long list_size = PAGE_SIZE / sizeof(struct page *); unsigned int gup_flags = FOLL_LONGTERM; unsigned long npages, cur_base, map_pfn, last_pfn = 0; - unsigned long lock_limit, sz2pin, nchunks, i; + unsigned long lock_limit, sz2pin, i; unsigned long page_offset; u64 start = iova; long pinned; @@ -1185,7 +1185,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, cur_base = uaddr & PAGE_MASK; iova &= PAGE_MASK; - nchunks = 0; while (npages) { sz2pin = min_t(unsigned long, npages, list_size); @@ -1200,7 +1199,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, } goto out; } - nchunks++; if (!last_pfn) map_pfn = page_to_pfn(page_list[0]); @@ -1231,7 +1229,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, map_pfn = this_pfn; iova += csize; - nchunks = 0; } last_pfn = this_pfn; @@ -1246,7 +1243,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, PFN_PHYS(map_pfn), perm, NULL); out: if (ret) { - if (nchunks) { + if (last_pfn) { unsigned long pfn; /* @@ -1258,7 +1255,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, * the corresponding unpinning will be handled by * vdpa_unmap(). */ - WARN_ON(!last_pfn); for (pfn = map_pfn; pfn <= last_pfn; pfn++) unpin_user_page(pfn_to_page(pfn)); } -- 2.53.0