KVM: arm64: Fix potential leak in hyp_trace_buffer_alloc_bpages_backing

In the very unlikely event of a failure in __map_hyp, the allocated
backing pages are leaked in hyp_trace_buffer_alloc_bpages_backing(). Fix
this by freeing the pages on error.

Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260710114819.2689386-2-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/hyp_trace.c b/arch/arm64/kvm/hyp_trace.c
index 9bfa368dd84152bd93dd59efebc28af882379258..aabf2989d70d3d4678f38c8899c88df9ebbfc47c 100644 (file)
--- a/arch/arm64/kvm/hyp_trace.c
+++ b/arch/arm64/kvm/hyp_trace.c
@@ -154,6 +154,7 @@ static int hyp_trace_buffer_alloc_bpages_backing(struct hyp_trace_buffer *trace_
        int nr_bpages = (PAGE_ALIGN(size) / PAGE_SIZE) + 1;
        size_t backing_size;
        void *start;
+       int ret;
 
        backing_size = PAGE_ALIGN(sizeof(struct simple_buffer_page) * nr_bpages *
                                  num_possible_cpus());
@@ -162,10 +163,16 @@ static int hyp_trace_buffer_alloc_bpages_backing(struct hyp_trace_buffer *trace_
        if (!start)
                return -ENOMEM;
 
+       ret = __map_hyp(start, backing_size);
+       if (ret) {
+               free_pages_exact(start, backing_size);
+               return ret;
+       }
+
        trace_buffer->desc->bpages_backing_start = (unsigned long)start;
        trace_buffer->desc->bpages_backing_size = backing_size;
 
-       return __map_hyp(start, backing_size);
+       return ret;
 }
 
 static void hyp_trace_buffer_free_bpages_backing(struct hyp_trace_buffer *trace_buffer)