[PATCH] KVM: arm64: Fix error path in init_hyp_mode()

[Quentin Perret]

On Wednesday 25 Jun 2025 at 11:33:01 (+0000), Mostafa Saleh wrote:
> diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
> index 38a91bb5d4c7..5bb36c3b06b5 100644
> --- a/arch/arm64/kvm/arm.c
> +++ b/arch/arm64/kvm/arm.c
> @@ -2344,15 +2344,22 @@ static void __init teardown_hyp_mode(void)
>  	int cpu;
>  
>  	free_hyp_pgds();
> +	/* Order matches the order of initialization init_hyp_mode() */
>  	for_each_possible_cpu(cpu) {
> +		if (!per_cpu(kvm_arm_hyp_stack_base, cpu))
> +			continue;
>  		free_pages(per_cpu(kvm_arm_hyp_stack_base, cpu), NVHE_STACK_SHIFT - PAGE_SHIFT);
> +
> +		if (!kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu])
> +			continue;
>  		free_pages(kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu], nvhe_percpu_order());
>  
>  		if (free_sve) {
>  			struct cpu_sve_state *sve_state;
>  
>  			sve_state = per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->sve_state;
> -			free_pages((unsigned long) sve_state, pkvm_host_sve_state_order());
> +			if (sve_state)
> +				free_pages((unsigned long) sve_state, pkvm_host_sve_state_order());

I'm a bit confused by these extra checks -- free_pages() should be safe
to call on NULL?

IIUC correctly, the actual issue is that per_cpu_ptr_nvhe_sym() will
dereference the per-cpu pages to find the sve state, which is entirely
bogus if the per-cpu pages have not been allocated. Now, looking at
this, it looks like the bigger problem is that we literally free the
per-cpu pages right before the sve state...

Should we at least change the freeing order here?

Thanks,
Quentin