Re: [PATCH v2] x86/sev: Fix kmemleak false positive for the RMP segment descriptors

[Tom Lendacky]

On 11/3/26 08:01, Breno Leitao wrote:
> kmemleak reports the RMP segment descriptor as leaked on SEV-SNP hosts:
> 
>   unreferenced object 0xff11000140e23b40 (size 32):
>     comm "swapper/0", pid 1, jiffies 4294680964
>     hex dump (first 32 bytes):
>       00 00 00 40 00 00 a0 ff 00 fc 05 04 00 00 00 00  ...@............
>       00 c0 5f 40 00 00 00 00 00 00 00 00 00 00 00 00  .._@............
>     backtrace (crc abf63fca):
>       __kmalloc_cache_noprof+0x2e2/0x650
>       alloc_rmp_segment_desc+0xdf/0x250
>       setup_contiguous_rmptable+0xb0/0xd0
>       setup_rmptable+0x13/0x60
>       snp_rmptable_init+0x45/0xd0
>       iommu_snp_enable+0x77/0xb0
>       state_next+0x184/0xed0
>       iommu_go_to_state+0x3a/0x90
>       pci_iommu_init+0x32/0x50
> 
> The descriptor is still in use: get_raw_rmpentry() reads it on every RMP
> lookup. Its only reference lives in rmp_segment_table[], and
> alloc_rmp_segment_table() takes that table from the page allocator.
> kmemleak does not scan page allocator memory, so it never sees the
> reference and reports the descriptor as leaked.
> 
> Nothing requires the table to come from the page allocator, so allocate
> it with kzalloc(). kmemleak tracks and scans slab objects, so it now
> sees the descriptor pointers in the table.
> 
> Fixes: 0f14af0d1d7d ("x86/sev: Treat the contiguous RMP table as a single RMP segment")
> Suggested-by: Dave Hansen <dave.hansen@xxxxxxxxx>
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>

Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>

> ---
> Changes in v2:
> - Allocate rmp_segment_table with kzalloc() instead of registering the
>   page with kmemleak (Dave Hansen)
> - Add the Fixes: and Suggested-by: tags
> - Link to v1: https://patch.msgid.link/20261102-sev-rmp-kmemleak-v1-1-e6fb2eb96e79@xxxxxxxxxx
> ---
>  arch/x86/virt/svm/sev.c | 10 +++-------
>  1 file changed, 3 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
> index bd70c4d0b774a3..18141c93b6d7c8 100644
> --- a/arch/x86/virt/svm/sev.c
> +++ b/arch/x86/virt/svm/sev.c
> @@ -361,7 +361,7 @@ static void __init free_rmp_segment_table(void)
>  		kfree(desc);
>  	}
>  
> -	free_page((unsigned long)rmp_segment_table);
> +	kfree(rmp_segment_table);
>  
>  	rmp_segment_table = NULL;
>  }
> @@ -369,14 +369,10 @@ static void __init free_rmp_segment_table(void)
>  /* Allocate the table used to index into the RMP segments */
>  static bool __init alloc_rmp_segment_table(void)
>  {
> -	struct page *page;
> -
> -	page = alloc_page(__GFP_ZERO);
> -	if (!page)
> +	rmp_segment_table = kzalloc(RST_SIZE, GFP_KERNEL);
> +	if (!rmp_segment_table)
>  		return false;
>  
> -	rmp_segment_table = page_address(page);
> -
>  	return true;
>  }
>  
> 
> ---
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> change-id: 20261102-sev-rmp-kmemleak-053969ac2126
> 
> Best regards,
> --  
> Breno Leitao <leitao@xxxxxxxxxx>