diff mbox series

[v1] x86/kvm: Fix the decrypted pages free in kvmclock

Message ID 20240612111201.18012-1-lirongqing@baidu.com (mailing list archive)
State New, archived
Headers show
Series [v1] x86/kvm: Fix the decrypted pages free in kvmclock | expand

Commit Message

Li RongQing June 12, 2024, 11:12 a.m. UTC
When set_memory_decrypted() fails, pages may be left fully or partially
decrypted. before free the pages to return pool, it should be encrypted
via set_memory_encrypted(), or else this could lead to functional or
security issues, if encrypting the pages fails, leak the pages

Fixes: 6a1cac56f41f ("x86/kvm: Use __bss_decrypted attribute in shared variables")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 arch/x86/kernel/kvmclock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 5b2c152..5e9f9d2 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -228,7 +228,8 @@  static void __init kvmclock_init_mem(void)
 		r = set_memory_decrypted((unsigned long) hvclock_mem,
 					 1UL << order);
 		if (r) {
-			__free_pages(p, order);
+			if (!set_memory_encrypted((unsigned long)hvclock_mem, 1UL << order))
+				__free_pages(p, order);
 			hvclock_mem = NULL;
 			pr_warn("kvmclock: set_memory_decrypted() failed. Disabling\n");
 			return;