If copying the result back to the caller fails, XENPF_add_memtype
tries to undo mtrr_add_page() with mtrr_del_page(ret, 0, 0). By then
ret holds -EFAULT, so mtrr_del_page() looks up an MTRR with base and
size 0 and releases nothing. The register that was added, or whose
usage count was raised, stays in use, and the caller only gets
-EFAULT, without the register number it would need to delete it.

Pass the register number saved in op->u.add_memtype.reg instead.

Fixes: 8ee614278c2d ("[XEN] Fix memtype accessor domctls.")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Build-tested only (x86_64 defconfig); not run.

 xen/arch/x86/platform_hypercall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c
index 6dee4922f3..0f3c791fc2 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -295,7 +295,7 @@ ret_t do_platform_op(
             ret = __copy_field_to_guest(u_xenpf_op, op, u.add_memtype) ?
                   -EFAULT : 0;
             if ( ret != 0 )
-                mtrr_del_page(ret, 0, 0);
+                mtrr_del_page(op->u.add_memtype.reg, 0, 0);
         }
         break;
 
-- 
2.43.0

On 04.11.2026 05:50, Yuho Choi wrote:
> If copying the result back to the caller fails, XENPF_add_memtype
> tries to undo mtrr_add_page() with mtrr_del_page(ret, 0, 0). By then
> ret holds -EFAULT, so mtrr_del_page() looks up an MTRR with base and
> size 0 and releases nothing. The register that was added, or whose
> usage count was raised, stays in use, and the caller only gets
> -EFAULT, without the register number it would need to delete it.
> 
> Pass the register number saved in op->u.add_memtype.reg instead.
> 
> Fixes: 8ee614278c2d ("[XEN] Fix memtype accessor domctls.")
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
for the immediate purpose. However, I wonder if we shouldn't drop the
rollback. Elsewhere when the final copy-out of a hypercall fails, we
don't do any such rollback.

Jan

> --- a/xen/arch/x86/platform_hypercall.c
> +++ b/xen/arch/x86/platform_hypercall.c
> @@ -295,7 +295,7 @@ ret_t do_platform_op(
>              ret = __copy_field_to_guest(u_xenpf_op, op, u.add_memtype) ?
>                    -EFAULT : 0;
>              if ( ret != 0 )
> -                mtrr_del_page(ret, 0, 0);
> +                mtrr_del_page(op->u.add_memtype.reg, 0, 0);
>          }
>          break;
>