KVM: arm64: Fix memory leak in hyp_trace_unload()

During trace remote loading, hyp_trace_load() allocates the descriptor
pages but fails to store the allocated size in trace_buffer->desc_size.
As a result, when unloading the trace buffer, hyp_trace_unload() calls
free_pages_exact() with a size of 0 which fails to free the memory.

Fix this by updating the descriptor size in trace_buffer->desc_size.

Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260521124613.911067-4-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/kvm/hyp_trace.c b/arch/arm64/kvm/hyp_trace.c
index 8595f9bdb3dcb9e30b6825f34e20559e25297a84..c4b3ee5521313f79552818a20a6e27892aa49f99 100644 (file)
--- a/arch/arm64/kvm/hyp_trace.c
+++ b/arch/arm64/kvm/hyp_trace.c
@@ -249,6 +249,7 @@ static struct trace_buffer_desc *hyp_trace_load(unsigned long size, void *priv)
                goto err_free_desc;
 
        trace_buffer->desc = desc;
+       trace_buffer->desc_size = desc_size;
 
        ret = hyp_trace_buffer_alloc_bpages_backing(trace_buffer, size);
        if (ret)
@@ -298,6 +299,7 @@ static void hyp_trace_unload(struct trace_buffer_desc *desc, void *priv)
        hyp_trace_buffer_free_bpages_backing(trace_buffer);
        free_pages_exact(trace_buffer->desc, trace_buffer->desc_size);
        trace_buffer->desc = NULL;
+       trace_buffer->desc_size = 0;
 }
 
 static int hyp_trace_enable_tracing(bool enable, void *priv)