From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585521; b=nqlt47LdZEAvc2I4BycVmEuE2UeGAgY9C5k/vUHGckDLMyQF3NHx1xBJeLB6+B8Y0fLn ZXZljngyyjCza2F2MLF9fkkd4fqLc81VRqPv+z3H2pnaFbv9gUFSDveG7pc2JwlgoYUQi hJjEdDW0ZuQVpLyWTpolPMLRq2tge0UnrsyI9TK2D0qhdbqCtvnesl6fNTo88SnbcaLH5 Z7ZjQ0v8KyxBeqNoVARL0Te0FOp33g7Dw08jEP7mrJtz9MQdHQ8o4bU2Zbta0MCGdsZIV ET1oXKF8j6luKAHq4A39OSBW/xAvJPrq25jV53Jb/FuEThgkPqoygp8zTDV3M4ZjIeQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585521; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=YfUeGjE6ZeZOvKy6eICUTES32WVthl/sYOwxJj2TV8E=; b=Bd1hRAo3EokFq2qtcoW/AmYHpOXlTlEbfv6iCA+jg5ZS7L63aXrLKfCzRb/LkuB/5kFM xl5pSH/5dvWvaXX948trSGMjJN+a86F7+O1gPlmUVGJ9Pz9uMdAnDDUSZ3TVl4o90Lk3R HOaavgeE60T4fbfhtpXCoT7ObDadEFUXXEDjtpvtBLlCxpAqL3szz24s5ibM1Xee0n/7j HP3yEK4shFLcmT3w2OJnfUKpO3Ozek0kqsheBa3xY0++ShV/e0nWhBJgbSJLklxkCKx0W lzuHbd+HCXEwnl1VXUE1Lk7qMaMVeNL/0aNYlLV262cYf0dyyVx+t8UZgs3GP9ISbzQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ru331n9z; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 041B9606EBBC; Fri, 13 Nov 2026 15:58:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ru331n9z Received: by smtp.kernel.org (Postfix) with ESMTPSA id A56381F000C4; Fri, 13 Nov 2026 15:58:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585520; bh=YfUeGjE6ZeZOvKy6eICUTES32WVthl/sYOwxJj2TV8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ru331n9zgoskcxYw2zGp5XVayY3qatJQ5HzzP4V6zBytS2jYulRqU6Ytnc96hVS1P 21uJQ+/wtIS2hwwDKf1Grq5A0CoNi6jhxy37pKbmsvAf0WYCH+5VZx+eYPxzuv+Co3 hUYUOPhAszwdPko6rdBqybUu1F0WBpAjSY3fDrR8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tal Zussman , Linfeng Sun , "Michael S. Tsirkin" , Sasha Levin Subject: [PATCH 7.3 164/507] vhost-vdpa: fix pinned page leak in vhost_vdpa_pa_map() error path Date: Fri, 13 Nov 2026 10:47:48 -0500 Message-ID: <20261113153800.052470404@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tal Zussman [ Upstream commit fd1462c96bafe2cb14e88c837b270f8990b717b5 ] When pin_user_pages() or vhost_vdpa_map() fails, vhost_vdpa_pa_map() is supposed to unpin the pages pinned after the last successfully mapped chunk, i.e. the range [map_pfn, last_pfn]. The unpin is guarded by nchunks, but nchunks is reset to 0 every time a chunk is mapped from inside the current page list, so a failure after any such boundary leaves that pending range pinned forever. With physically scattered memory nearly every page list contains a boundary, so the leak happens on practically every failed IOTLB update. The pending range is non-empty exactly when a page has been pinned, which last_pfn already tells us, so drop nchunks and test last_pfn. Fixes: ad89653f79f1 ("vhost-vdpa: fix page pinning leakage in error path (rework)") Cc: stable@vger.kernel.org Signed-off-by: Tal Zussman Reported-by: Linfeng Sun Signed-off-by: Michael S. Tsirkin Message-ID: <20261031-vhost-vdpa-unpin-v1-1-94ffc9683256@columbia.edu> Signed-off-by: Sasha Levin --- drivers/vhost/vdpa.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index a31786796d4ce..c7a9702c2447b 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -1151,7 +1151,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, unsigned long list_size = PAGE_SIZE / sizeof(struct page *); unsigned int gup_flags = FOLL_LONGTERM; unsigned long npages, cur_base, map_pfn, last_pfn = 0; - unsigned long lock_limit, sz2pin, nchunks, i; + unsigned long lock_limit, sz2pin, i; unsigned long page_offset; u64 start = iova; long pinned; @@ -1187,7 +1187,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, cur_base = uaddr & PAGE_MASK; iova &= PAGE_MASK; - nchunks = 0; while (npages) { sz2pin = min_t(unsigned long, npages, list_size); @@ -1202,7 +1201,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, } goto out; } - nchunks++; if (!last_pfn) map_pfn = page_to_pfn(page_list[0]); @@ -1233,7 +1231,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, map_pfn = this_pfn; iova += csize; - nchunks = 0; } last_pfn = this_pfn; @@ -1248,7 +1245,7 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, PFN_PHYS(map_pfn), perm, NULL); out: if (ret) { - if (nchunks) { + if (last_pfn) { unsigned long pfn; /* @@ -1260,7 +1257,6 @@ static int vhost_vdpa_pa_map(struct vhost_vdpa *v, * the corresponding unpinning will be handled by * vdpa_unmap(). */ - WARN_ON(!last_pfn); for (pfn = map_pfn; pfn <= last_pfn; pfn++) unpin_user_page(pfn_to_page(pfn)); } -- 2.53.0