From 47365056686efccb3d927cbe35a73cfa0d2e0122 Mon Sep 17 00:00:00 2001 From: Keir Fraser Date: Mon, 28 Jul 2025 06:41:19 +0000 Subject: [PATCH] ANDROID: KVM: arm64: poison/account relinquished pages after unmap If the page is poisoned and accounted before the unmap: 1. The guest has a window to access and dirty the page after the poison and related CMOs 2. If the unmap fails, the hypercall has visible side effect (poisoning) and leaves an incorrect PSCI MEM_PROTECT count. Bug: 357781595 Bug: 433953177 Change-Id: Id67f2dda632bca686e2509f1c64d08743deef199 Signed-off-by: Keir Fraser --- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c index 1d36fd64d42b..bec0ebf25e80 100644 --- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c +++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c @@ -431,14 +431,14 @@ int __pkvm_guest_relinquish_to_host(struct pkvm_hyp_vcpu *vcpu, goto end; } - hyp_poison_page(phys, PAGE_SIZE); - psci_mem_protect_dec(1); - /* Zap the guest stage2 pte and return ownership to the host */ ret = kvm_pgtable_stage2_unmap(&vm->pgt, ipa, PAGE_SIZE); if (ret) goto end; + hyp_poison_page(phys, PAGE_SIZE); + psci_mem_protect_dec(1); + WARN_ON(host_stage2_set_owner_locked(phys, PAGE_SIZE, PKVM_ID_HOST)); end: guest_unlock_component(vm);