Re: [PATCH] virt: sev-guest: Fix lifetime of message descriptor

[Borislav Petkov]

On Sat, Aug 22, 2026 at 09:35:03PM +0900, Kohei Enju wrote:
> sev_guest_probe() registers the TSM provider before assigning
> snp_dev->msg_desc. Once the provider is registered, a concurrent
> configfs report request can reach get_ext_report() and dereference a
> NULL message descriptor.

How can this happen? This is a driver probe function and someone must very
quickly do that configfs report request?
> 
> Additionally, sev_guest_remove() frees the message descriptor before the
> managed TSM unregister action runs, allowing the provider to access the
> freed descriptor.
> 
> Assign snp_dev->msg_desc before registering the TSM provider. Add a
> managed cleanup action for the message descriptor before adding the TSM
> unregister action. Since devres actions run in LIFO order, the TSM
> provider is unregistered before the message descriptor is freed both
> during probe failure and driver removal.

Can we get rid of those managed actions instead and do proper unwinding?

There's a single devm_add_action_or_reset() right smack in the middle of the
probe flow and I'd prefer if we don't add more but have proper and balanced
unwinding.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette