In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure<\/p>\n
In kvmppc_svm_page_in(), if uv_page_in() fails after
\nkvmppc_uvmem_get_page() has succeeded, the secure device page is never
\nreleased. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
\nallocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
\nKVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
\nrefcount=1 and locks the page. The subsequent goto out_finalize skips
\nthe *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
\npage, and none of those resources are ever reclaimed.<\/p>\n
Each occurrence permanently consumes one entry from the firmware-bounded
\nsecure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
\nmarked as secure \u2014 making it unusable for the lifetime of the VM.<\/p>\n
The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
\nfailure correctly with unlock_page(dpage); __free_page(dpage). Apply
\nthe same pattern here: unlock_page() followed by put_page(), which
\nchains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
\nto clear the bitmap bit, free pvt, and reset the GFN state.<\/p>\n
Reachable whenever uv_page_in() returns an error (e.g. UV pool
\nexhaustion) on any POWER9\/10 + Ultravisor\/PEF system.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure<\/p>\n
In kvmppc_svm_page_in(), if uv_page_in() fails after
\nkvmp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40905","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}