Daily update · Sep 16–17, 2026
PowerPC KVM fixes address use-after-free, secure-page leak, and TCE overflow
Three targeted patches harden PowerPC KVM and IOMMU paths.
In brief
These commits fix three distinct bugs in PowerPC KVM and related IOMMU code. One prevents a use-after-free during nested-guest TLB invalidation, another plugs a secure memory leak on a failure path, and the third corrects an overflow check for multi-page TCE operations. All are targeted fixes rather than new features.
Bug fixes
Fix use-after-free in nested-guest TLB invalidation
kvmhv_emulate_tlbie_all_lpid() iterates nested-guest entries and temporarily drops mmu_lock without holding a reference on the kvm_nested_guest pointer. A concurrent vCPU can free that structure during the window, leaving a dangling pointer. The fix takes a reference inside the loop before dropping the lock.
Why it matters: Prevents a race that could lead to memory corruption or a crash when handling TLB invalidation for nested guests.
Fix secure device page leak on uv_page_in() failure
In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() succeeds, the secure device page is never released. The failure path skips the assignment needed for migrate_vma_finalize() to reclaim the page, leaking a firmware-bounded secure memory entry and associated metadata.
Why it matters: Prevents gradual exhaustion of the secure memory pool and stale secure-page markings after a failed page-in operation.
Fix overflow validation in TCE IOBA check
The unified iommu_tce_check_ioba() ignored the caller's npages value and always validated a single page. This missed overflows for multi-page TCE operations such as H_STUFF_TCE and H_PUT_TCE_INDIRECT. The fix accounts for npages and checks the full requested range against the table capacity.
Why it matters: Closes a validation gap that could allow out-of-range TCE accesses in KVM and VFIO paths.
Source commits3 entries +
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
Amit Machhiwal · Sep 15, 2026 · 1 files
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
Amit Machhiwal · Sep 15, 2026 · 1 files
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Shivaprasad G Bhat · Sep 15, 2026 · 1 files