From nobody Mon Sep 28 16:21:51 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5DE6A369206; Thu, 20 Aug 2026 15:00:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238060; cv=none; b=Jv0G7x6d+XtYS2TUmUedlriXRslbMxxwnzddRWwGql9j31EzMxSL051VTnXPgCXMN7RPSSiFjbIrs7s2w7VcxOEIdZ0Hw6LaMVkOqLdj265cUKmcIW3jfwx4UhLypAtZ5SqRXVSukTHt5FltgUPpy8zZ7fwoNRMRn4Xsqs9CRjo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238060; c=relaxed/simple; bh=yiXHLW2hxd28E7satGbfCpdtNX7Djkd4B3UsK9jXuSY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QRlIZSrGz34me/zxw1QI2noK6GYl84K/iieZl9c9/NEWb1v5R0bPe389uDQ5GxxclFO+28lzeYTKpAS3SGMnSuN0XmlsGk6j7EBJ4FV8eRKdbph/aBlw5Xzqk9Q8snArn1Bq9RadwYl4acphyHB4IVUpc+/JOoo+LdzBXJmEv6A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=X0e4gMfP; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="X0e4gMfP" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D630D1BCA; Thu, 20 Aug 2026 08:00:50 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.29]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id CD05F3F85F; Thu, 20 Aug 2026 08:00:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1787238054; bh=yiXHLW2hxd28E7satGbfCpdtNX7Djkd4B3UsK9jXuSY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X0e4gMfPovvYXck0tTBhHOmJLMstfkUnCnNqiDzYXhSNYcwY3Gug1gjBOr+tjVOJv mxdYYezRnNcKpvJ/DWTDz21EfzV8KUWJN31ZLfCD+LL0EPFY8ZNo1S97Loms+GN+E3 eACpp3CmwR4hNNEJB02ekqu0uQWJK7SBhVMqUZxM= From: Steven Price To: =?UTF-8?q?Christian=20K=C3=B6nig?= , Marc Zyngier , Sumit Semwal , Thomas Gleixner Cc: Steven Price , "T.J. Mercier" , Benjamin Gaignard , Brian Starkey , John Stultz , dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Jason Gunthorpe , Jiri Pirko , Marek Szyprowski , Suzuki K Poulose , Jason Gunthorpe Subject: [PATCH v2 1/4] irqchip/gic-v3-its: Zero shared pages after conversion Date: Thu, 20 Aug 2026 16:00:30 +0100 Message-ID: <20260820150034.88729-2-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260820150034.88729-1-steven.price@arm.com> References: <20260820150034.88729-1-steven.price@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" its_alloc_pages_node() passes __GFP_ZERO to the page allocator before calling set_memory_decrypted(). This assumes that converting a page from private to shared preserves its contents. For Arm CCA with MEC (Memory Encryption Contexts) the key used to access the page will change, and so by default the visible data will change. The host could ensure that it zeros the page, but rather than relying on the host's behaviour it's best if the guest simply zeros after the decryption rather than before. Specifically in this case the ITS tables are required to be zeroed. Mask out __GFP_ZERO from the allocation request, and do the zeroing as a separate step after decryption. Reviewed-by: Jason Gunthorpe Fixes: b08e2f42e86b ("irqchip/gic-v3-its: Share ITS tables with a non-trust= ed hypervisor") Signed-off-by: Steven Price --- drivers/irqchip/irq-gic-v3-its.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-= its.c index 6f5811aae59c..a055837832bc 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -213,16 +213,18 @@ static gfp_t gfp_flags_quirk; static struct page *its_alloc_pages_node(int node, gfp_t gfp, unsigned int order) { + bool want_zero =3D gfp & __GFP_ZERO; struct page *page; int ret =3D 0; =20 - page =3D alloc_pages_node(node, gfp | gfp_flags_quirk, order); + page =3D alloc_pages_node(node, (gfp & ~__GFP_ZERO) | gfp_flags_quirk, + order); =20 if (!page) return NULL; =20 ret =3D set_memory_decrypted((unsigned long)page_address(page), - 1 << order); + BIT(order)); /* * If set_memory_decrypted() fails then we don't know what state the * page is in, so we can't free it. Instead we leak it. @@ -231,6 +233,9 @@ static struct page *its_alloc_pages_node(int node, gfp_= t gfp, if (ret) return NULL; =20 + if (want_zero) + clear_pages(page_address(page), BIT(order)); + return page; } =20 --=20 2.43.0 From nobody Mon Sep 28 16:21:51 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id CE11D2417DE; Thu, 20 Aug 2026 15:00:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238064; cv=none; b=Ai2tN54CG2Z73dx9U5V2AlDCKo/cr8nYq9Ztk1UOxt00cKSoQI5fNp4IgeCStoTT+tAZgDua5Xqe1RVVKZ3SA2J9KkFD9hQrX2zs5Ti2MKbEt6vUJXLaAlASWgl2pHxQGt6CLeOGEDLqEnz3Xv6iC4lkPm3i3HQeRDjwgJe+Ub0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238064; c=relaxed/simple; bh=W39nx0xUvQJFDw697gXlKmqlgDRLETj5+HJFQQSKQkI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=InSh+v0I5Mx1PvzSaBy9NN+W5sOvXRPIuPwlirISVzuX920vThk9U5RwZOflI9inc1Y7dYhcaQit3J05QU4muqPH7O7ZQys2FHoZ5j2DNW/MKLxjXj35lPMzZJc/XIgxhvDriycUo96KhZ9lxTW55qxbvxq6PrPpqEvyCtXmfNM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=AjxZSDWa; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="AjxZSDWa" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id EED5A153B; Thu, 20 Aug 2026 08:00:54 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.29]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 220C63F85F; Thu, 20 Aug 2026 08:00:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1787238058; bh=W39nx0xUvQJFDw697gXlKmqlgDRLETj5+HJFQQSKQkI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AjxZSDWaR3zUDofIoYP4OkhXqP2BE1MDLKVayMvkr6CkpeiVhTModGpFIXVU5R3m9 UZG3h8VXUUc7GRZcLrcnLXZEO2ukRZ2b9md9B3SS1FWqF/7jup+TGut3iatGo3wvqH wZnOou0gPsmodKHI9OY3VmAQrwZQtfXDjkBQM0GU= From: Steven Price To: =?UTF-8?q?Christian=20K=C3=B6nig?= , Marc Zyngier , Sumit Semwal , Thomas Gleixner Cc: Steven Price , "T.J. Mercier" , Benjamin Gaignard , Brian Starkey , John Stultz , dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Jason Gunthorpe , Jiri Pirko , Marek Szyprowski , Suzuki K Poulose Subject: [PATCH v2 2/4] irqchip/gic-v3-its: Allocate VPE tables from sleepable context Date: Thu, 20 Aug 2026 16:00:31 +0100 Message-ID: <20260820150034.88729-3-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260820150034.88729-1-steven.price@arm.com> References: <20260820150034.88729-1-steven.price@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The VPE L1 table is allocated from the CPU-starting hotplug state, where interrupts are disabled. Although the page allocation uses GFP_ATOMIC, its_alloc_pages() subsequently calls set_memory_decrypted(), which can sleep while splitting the arm64 linear map. Move the allocation to the existing CPU-online callback, which runs in sleepable context, and use GFP_KERNEL for both allocations performed there. Register the callback even without EFI, since it is now also responsible for VPE table allocation. Fixes: b08e2f42e86b ("irqchip/gic-v3-its: Share ITS tables with a non-trust= ed hypervisor") Signed-off-by: Steven Price --- drivers/irqchip/irq-gic-v3-its.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-= its.c index a055837832bc..71515dbff9ec 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -2932,7 +2932,7 @@ static int allocate_vpe_l1_table(void) if (val & GICR_VPROPBASER_4_1_VALID) goto out; =20 - gic_data_rdist()->vpe_table_mask =3D kzalloc_obj(cpumask_t, GFP_ATOMIC); + gic_data_rdist()->vpe_table_mask =3D kzalloc_obj(cpumask_t, GFP_KERNEL); if (!gic_data_rdist()->vpe_table_mask) return -ENOMEM; =20 @@ -2999,7 +2999,7 @@ static int allocate_vpe_l1_table(void) =20 pr_debug("np =3D %d, npg =3D %lld, psz =3D %d, epp =3D %d, esz =3D %d\n", np, npg, psz, epp, esz); - page =3D its_alloc_pages(GFP_ATOMIC | __GFP_ZERO, get_order(np * PAGE_SIZ= E)); + page =3D its_alloc_pages(GFP_KERNEL | __GFP_ZERO, get_order(np * PAGE_SIZ= E)); if (!page) return -ENOMEM; =20 @@ -3268,16 +3268,6 @@ static void its_cpu_init_lpis(void) val =3D its_clear_vpend_valid(vlpi_base, 0, 0); } =20 - if (allocate_vpe_l1_table()) { - /* - * If the allocation has failed, we're in massive trouble. - * Disable direct injection, and pray that no VM was - * already running... - */ - gic_rdists->has_rvpeid =3D false; - gic_rdists->has_vlpis =3D false; - } - /* Make sure the GIC has seen the above */ dsb(sy); gic_data_rdist()->flags |=3D RD_LOCAL_LPI_ENABLED; @@ -5452,6 +5442,19 @@ static int its_cpu_memreserve_lpi(unsigned int cpu) if (gic_data_rdist()->flags & RD_LOCAL_MEMRESERVE_DONE) return 0; =20 + if (allocate_vpe_l1_table()) { + /* + * If the allocation has failed, we're in massive trouble. + * Disable direct injection, and pray that no VM was + * already running... + */ + gic_rdists->has_rvpeid =3D false; + gic_rdists->has_vlpis =3D false; + } + + if (!efi_enabled(EFI_CONFIG_TABLES)) + goto out; + pend_page =3D gic_data_rdist()->pend_page; if (WARN_ON(!pend_page)) { ret =3D -ENOMEM; @@ -5793,9 +5796,6 @@ int __init its_lpi_memreserve_init(void) { int state; =20 - if (!efi_enabled(EFI_CONFIG_TABLES)) - return 0; - if (list_empty(&its_nodes)) return 0; =20 --=20 2.43.0 From nobody Mon Sep 28 16:21:52 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 7097236A37A; Thu, 20 Aug 2026 15:01:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238065; cv=none; b=iVty7s2RAd4M6X29QcPW2kwrPakOG/8ZksPQtRsm+O5G41ezt1lPIfMdPkS2u4IKTciu6ZmCKS5Y9aNxPI+YW5AJwx4PkzkMcmnjr3xuRj/sEVcb6bpNPBg7NaKqPCKoqJ7zRfOLhwH86bOjl3GzaRiFCz9RXLx4c8BNj1gI1zg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238065; c=relaxed/simple; bh=H394JPwKh5ipjx6sMEgyDYJ0A1zAKvArd6u5QxFZBh4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BgUhz65tvltfJSLs0kccoiTt0FrMXKzVPeXTZfDks0fT0vQnQdV/PLCr1ebXLSefHhkk189gGBrTejI3T6nffB7HMBbpBNM8KGnvZWGLTkEGfev7YsZujLz2+SznSXo5buU0TUkrysN1sD8t1S8q+eyk80rkbLyiNPbQ3rRCvKM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=Ma6tz2BA; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="Ma6tz2BA" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id ED6E41BCA; Thu, 20 Aug 2026 08:00:58 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.29]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 398033F85F; Thu, 20 Aug 2026 08:00:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1787238062; bh=H394JPwKh5ipjx6sMEgyDYJ0A1zAKvArd6u5QxFZBh4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ma6tz2BAfOirAgwCL52wKz4U4JocafrPECKECXDxFMJVGrUtFe5TVjJLfoEHZwVcd 2fbXRiQgpsChx/8M8CZJMFewUOoA0XhabztzKG39rFilW8Vmyf9iV4DjIVxIsGzUbY RUyxOno7+OBcAKqNj/Tlm8ov3angvrNIaVsDZHEs= From: Steven Price To: =?UTF-8?q?Christian=20K=C3=B6nig?= , Marc Zyngier , Sumit Semwal , Thomas Gleixner Cc: Steven Price , "T.J. Mercier" , Benjamin Gaignard , Brian Starkey , John Stultz , dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Jason Gunthorpe , Jiri Pirko , Marek Szyprowski , Suzuki K Poulose , Jason Gunthorpe Subject: [PATCH v2 3/4] dma-buf: heaps: Zero system shared heap pages after conversion Date: Thu, 20 Aug 2026 16:00:32 +0100 Message-ID: <20260820150034.88729-4-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260820150034.88729-1-steven.price@arm.com> References: <20260820150034.88729-1-steven.price@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The system_cc_shared heap allocates pages with __GFP_ZERO before converting them from private to shared with set_memory_decrypted(). This assumes that the conversion preserves the contents of the pages. For Arm CCA with MEC (Memory Encryption Contexts) the key used to access the page will change, and so by default the visible data will change. The host could ensure that it zeros the page after decryption, but rather than relying on the host's behaviour it's best if the guest simply zeros after the decryption rather than before. For CC shared buffers, defer zeroing until each page has been converted successfully. For other buffers keep the existing behaviour. Reviewed-by: Jason Gunthorpe Fixes: 78b30c50a7ac ("dma-buf: heaps: system: add system_cc_shared heap for= explicitly shared memory") Signed-off-by: Steven Price --- drivers/dma-buf/heaps/system_heap.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/sy= stem_heap.c index c8959eadc71d..f14930904089 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -376,7 +376,8 @@ static const struct dma_buf_ops system_heap_buf_ops =3D= { }; =20 static struct page *alloc_largest_available(unsigned long size, - unsigned int max_order) + unsigned int max_order, + bool defer_zero) { struct page *page; int i; @@ -388,6 +389,9 @@ static struct page *alloc_largest_available(unsigned lo= ng size, if (max_order < orders[i]) continue; flags =3D order_flags[i]; + /* Decryption can change the contents, so clear it afterwards. */ + if (defer_zero) + flags &=3D ~__GFP_ZERO; if (mem_accounting) flags |=3D __GFP_ACCOUNT; page =3D alloc_pages(flags, orders[i]); @@ -438,7 +442,8 @@ static struct dma_buf *system_heap_allocate(struct dma_= heap *heap, goto free_buffer; } =20 - page =3D alloc_largest_available(size_remaining, max_order); + page =3D alloc_largest_available(size_remaining, max_order, + cc_shared_buffer(buffer)); if (!page) goto free_buffer; =20 @@ -461,9 +466,12 @@ static struct dma_buf *system_heap_allocate(struct dma= _heap *heap, =20 if (cc_shared_buffer(buffer)) { for_each_sgtable_sg(table, sg, i) { - ret =3D system_heap_set_page_decrypted(sg_page(sg)); + page =3D sg_page(sg); + ret =3D system_heap_set_page_decrypted(page); if (ret) goto free_pages; + + clear_pages(page_address(page), 1 << compound_order(page)); } } =20 --=20 2.43.0 From nobody Mon Sep 28 16:21:52 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 3BCFB36A37A; Thu, 20 Aug 2026 15:01:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238071; cv=none; b=EuHtK8vFwXYSql8SWMrjrRMY9NHPFQmfmP0i3oi1doSlRcOX5pVwCMIFzYuSupQygNnQf6tKm4d689fmTHFB8gCkCGScKTfy9+GhwyqTqC1fljxhLZXrFiCS/8htNJ65A89+ar5475IETjPuriseQeExIXsNahCnQRBzc5bRj7M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787238071; c=relaxed/simple; bh=Adowm8TaRmLb4+nhfuTq8XG6Qz8i8b31EokqJq1SBFg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kgFb81rK9+r7JtwzL/q0MTtoBAoBDaIhYAtEDgBa3joAJprc+xp03th7U8UttZqJbuiySX5lPq/lAqRnzHE40/U8vaiTk/jMNtncZhUfSbbuOe30uWEUop+OY921e+jNRtS+wErTJZK12e0fQ55Hzkr7tYf3BN1m7J7akm4i9Ac= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=AnIbFs3q; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="AnIbFs3q" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4BB04153B; Thu, 20 Aug 2026 08:01:03 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.29]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 50FF43F85F; Thu, 20 Aug 2026 08:01:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1787238067; bh=Adowm8TaRmLb4+nhfuTq8XG6Qz8i8b31EokqJq1SBFg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AnIbFs3qOe6tXAa76/75xbIi30a6sclahiGuKAa7TNyNiW5Z+k4gQ8FETu4UTPSKO 8Juo5IUGdb+gncLLrOLJBF1w9IYh74/rR/FXRuJR7tsoW1Se2JDZh0t2glua/wxv1v ZHr2qdGjJiBb9RZp3FHVr1rdzV1QZD3j0HcXo/HU= From: Steven Price To: =?UTF-8?q?Christian=20K=C3=B6nig?= , Marc Zyngier , Sumit Semwal , Thomas Gleixner Cc: Steven Price , "T.J. Mercier" , Benjamin Gaignard , Brian Starkey , John Stultz , dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Jason Gunthorpe , Jiri Pirko , Marek Szyprowski , Suzuki K Poulose Subject: [PATCH v2 4/4] dma-buf: heaps: Fix shared system heap allocation rollback Date: Thu, 20 Aug 2026 16:00:33 +0100 Message-ID: <20260820150034.88729-5-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260820150034.88729-1-steven.price@arm.com> References: <20260820150034.88729-1-steven.price@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If converting one of the allocated pages to shared memory fails, the cleanup path attempts to convert every page back to private memory. Pages after the failed page have not been converted yet, so attempting to convert them back can fail and cause otherwise reusable memory to be leaked. Count the pages converted successfully and only convert those and the failed allocation back during cleanup. If converting the failed allocation back succeeds it can be freed safely; otherwise it is leaked because its state is unknown. Allocations that were not converted can be freed directly. Fixes: 78b30c50a7ac ("dma-buf: heaps: system: add system_cc_shared heap for= explicitly shared memory") Signed-off-by: Steven Price Reviewed-by: Jason Gunthorpe --- drivers/dma-buf/heaps/system_heap.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/sy= stem_heap.c index f14930904089..8d3ffeb64e00 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -418,6 +418,7 @@ static struct dma_buf *system_heap_allocate(struct dma_= heap *heap, struct scatterlist *sg; struct list_head pages; struct page *page, *tmp_page; + int nr_decrypted =3D 0; int i, ret =3D -ENOMEM; =20 buffer =3D kzalloc_obj(*buffer); @@ -472,6 +473,7 @@ static struct dma_buf *system_heap_allocate(struct dma_= heap *heap, goto free_pages; =20 clear_pages(page_address(page), 1 << compound_order(page)); + nr_decrypted++; } } =20 @@ -496,9 +498,11 @@ static struct dma_buf *system_heap_allocate(struct dma= _heap *heap, * Intentionally leak pages that cannot be re-encrypted * to prevent shared memory from being reused. */ - if (cc_shared_buffer(buffer) && - system_heap_set_page_encrypted(p)) - continue; + if (cc_shared_buffer(buffer)) { + if (i <=3D nr_decrypted && + system_heap_set_page_encrypted(p)) + continue; + } __free_pages(p, compound_order(p)); } sg_free_table(table); --=20 2.43.0