[tip: x86/sev] x86/sev: Fix kmemleak false positive for the RMP segment descriptors

[tip-bot2 for Breno Leitao]

The following commit has been merged into the x86/sev branch of tip:

Commit-ID:     641890fe65068455c73f45288bc6f5e435650dd6
Gitweb:        https://git.kernel.org/tip/641890fe65068455c73f45288bc6f5e435650dd6
Author:        Breno Leitao <leitao@xxxxxxxxxx>
AuthorDate:    Tue, 03 Nov 2026 06:01:56 -08:00
Committer:     Borislav Petkov (AMD) <bp@xxxxxxxxx>
CommitterDate: Sun, 08 Nov 2026 22:57:10 -08:00

x86/sev: Fix kmemleak false positive for the RMP segment descriptors

kmemleak reports the RMP segment descriptor as leaked on SEV-SNP hosts:

  unreferenced object 0xff11000140e23b40 (size 32):
    comm "swapper/0", pid 1, jiffies 4294680964
    hex dump (first 32 bytes):
      00 00 00 40 00 00 a0 ff 00 fc 05 04 00 00 00 00  ...@............
      00 c0 5f 40 00 00 00 00 00 00 00 00 00 00 00 00  .._@............
    backtrace (crc abf63fca):
      __kmalloc_cache_noprof
      alloc_rmp_segment_desc
      setup_contiguous_rmptable
      setup_rmptable
      snp_rmptable_init
      iommu_snp_enable
      state_next
      iommu_go_to_state
      pci_iommu_init

The descriptor is still in use: get_raw_rmpentry() reads it on every RMP lookup.
Its only reference lives in rmp_segment_table[], and alloc_rmp_segment_table()
takes that table from the page allocator.  kmemleak does not scan page allocator
memory, so it never sees the reference and reports the descriptor as leaked.

Nothing requires the table to come from the page allocator, so allocate it with
kzalloc(). kmemleak tracks and scans slab objects, so it now sees the descriptor
pointers in the table.

Fixes: 0f14af0d1d7d ("x86/sev: Treat the contiguous RMP table as a single RMP segment")
Suggested-by: Dave Hansen <dave.hansen@xxxxxxxxx>
Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Reviewed-by: Tom Lendacky <thomas.lendacky@xxxxxxx>
Link: https://patch.msgid.link/20261103-sev-rmp-kmemleak-v2-1-9c1ba28cf7c5@xxxxxxxxxx
---
 arch/x86/virt/svm/sev.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c
index 4de9681..62ec762 100644
--- a/arch/x86/virt/svm/sev.c
+++ b/arch/x86/virt/svm/sev.c
@@ -361,7 +361,7 @@ static void __init free_rmp_segment_table(void)
 		kfree(desc);
 	}
 
-	free_page((unsigned long)rmp_segment_table);
+	kfree(rmp_segment_table);
 
 	rmp_segment_table = NULL;
 }
@@ -369,14 +369,10 @@ static void __init free_rmp_segment_table(void)
 /* Allocate the table used to index into the RMP segments */
 static bool __init alloc_rmp_segment_table(void)
 {
-	struct page *page;
-
-	page = alloc_page(__GFP_ZERO);
-	if (!page)
+	rmp_segment_table = kzalloc(RST_SIZE, GFP_KERNEL);
+	if (!rmp_segment_table)
 		return false;
 
-	rmp_segment_table = page_address(page);
-
 	return true;
 }