[PATCH v2 0/2] KVM: selftests: Fix two VMs leaked on early returns

Gokul K posted 2 patches 1 month, 2 weeks ago
tools/testing/selftests/kvm/x86/nx_huge_pages_test.c | 3 ++-
tools/testing/selftests/kvm/x86/sev_smoke_test.c     | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
[PATCH v2 0/2] KVM: selftests: Fix two VMs leaked on early returns
Posted by Gokul K 1 month, 2 weeks ago
Two x86 selftests create a VM and then take an early return that skips the
kvm_vm_free() at the end of the function.  Both now jump to that existing
cleanup instead.

Patch 1 is the plain-SEV path of sev_smoke_test(), which returns straight
out of the UCALL_DONE case instead of leaving the loop.  The SEV-ES path
next to it breaks out and frees correctly.

Patch 2 is nx_huge_pages_test, which returns as soon as it has confirmed
that disabling NX huge pages is denied without CAP_SYS_BOOT.

The two patches are independent and either can be applied on its own.

Found by auditing every function under tools/testing/selftests/kvm/ that
creates a VM and later calls kvm_vm_free(), looking for returns in
between.  Seven other hits were false positives, mostly returns after
REPORT_GUEST_ASSERT() or TEST_FAIL(), which abort the process and make the
return unreachable.  Two more that do look real, in get-reg-list.c and
arm64/external_aborts.c, are left out because they belong to different
maintainers.

Compile-tested only.  This host has neither SEV (kvm_amd sev=N) nor hugetlb
configured, so both tests SKIP rather than run.

Note patch 1 touches sev_smoke_test.c, which an unrelated patch I sent
earlier also touches [1].  They modify different functions and do not
conflict in either order.

v2:
 - nx_huge_pages_test: goto the existing cleanup instead of open-coding
   kvm_vm_free() before the return, matching patch 1 (Sean)
 - Drop the claims that these paths never exercise VM teardown, and that
   the nx_huge_pages path is not obscure.  Neither justification holds
   up: teardown still happens, just at process exit, and how often a
   leaking path runs does not change whether it should be fixed (Sean)
 - Rebase onto current kvm-x86/next

[1] https://lore.kernel.org/all/20260807071026.195503-1-gokul02k@gmail.com/
v1: https://lore.kernel.org/all/20260808081050.408657-1-gokul02k@gmail.com/

Gokul K (2):
  KVM: selftests: Free the VM when the SEV smoke test's guest completes
  KVM: selftests: Free the VM when NX hugepage disabling is denied

 tools/testing/selftests/kvm/x86/nx_huge_pages_test.c | 3 ++-
 tools/testing/selftests/kvm/x86/sev_smoke_test.c     | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

-- 
2.54.0
Re: [PATCH v2 0/2] KVM: selftests: Fix two VMs leaked on early returns
Posted by Sean Christopherson 1 week ago
On Tue, 11 Aug 2026 10:30:27 +0530, Gokul K wrote:
> Two x86 selftests create a VM and then take an early return that skips the
> kvm_vm_free() at the end of the function.  Both now jump to that existing
> cleanup instead.
> 
> Patch 1 is the plain-SEV path of sev_smoke_test(), which returns straight
> out of the UCALL_DONE case instead of leaving the loop.  The SEV-ES path
> next to it breaks out and frees correctly.
> 
> [...]

Applied to kvm-x86 selftests, thanks!

[1/2] KVM: selftests: Free the VM when the SEV smoke test's guest completes
      https://github.com/kvm-x86/linux/commit/434c50e703c5
[2/2] KVM: selftests: Free the VM when NX hugepage disabling is denied
      https://github.com/kvm-x86/linux/commit/ebb702707896

--
https://github.com/kvm-x86/linux/tree/next