Oliver Upton 0c93681aea KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier ...

commit 9f76b039a7 upstream.

In the case that kvm_translate_vncr() races with an MMU notifier the
early return does not release a reference on the faulted in PFN. Add
the necessary call to kvm_release_faultin_page() for the unused PFN.

Cc: stable@vger.kernel.org
Fixes: 069a05e535 ("KVM: arm64: nv: Handle VNCR_EL2-triggered faults")
Reported-by: Sashiko (local):gemini-3.1-pro
Signed-off-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20260602235450.103057-2-oupton@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-18 16:53:33 +02:00

..

alpha

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

arc

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

arm

ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow

2026-06-19 13:44:05 +02:00

arm64

KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier

2026-07-18 16:53:33 +02:00

csky

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

hexagon

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

loongarch

LoongArch: KVM: Add missing slots_lock for device register/unregister

2026-07-18 16:53:32 +02:00

m68k

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

microblaze

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

mips

MIPS: smp: report dying CPU to RCU in stop_this_cpu()

2026-07-04 13:44:20 +02:00

nios2

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

openrisc

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

parisc

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

powerpc

bpf: Restrict JIT predictor flush to cBPF

2026-07-18 16:53:26 +02:00

riscv

riscv: mm: Unconditionally sfence.vma for spurious fault

2026-07-18 16:53:31 +02:00

s390

s390: Revert support for DCACHE_WORD_ACCESS

2026-07-18 16:53:20 +02:00

sh

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

sparc

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

um

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

x86

KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

2026-07-18 16:53:33 +02:00

xtensa

ring-buffer: Flush and stop persistent ring buffer on panic

2026-06-01 17:50:44 +02:00

.gitignore

…

Kconfig

compiler_types: Introduce __nocfi_generic

2025-10-29 20:04:55 -07:00