From nobody Mon Sep 21 16:41:25 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hpTWn6cSpz6srYC for ; Mon, 21 Sep 2026 16:41:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hpTWn5bRsz4pR1 for ; Mon, 21 Sep 2026 16:41:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790008885; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OimaqxiEApHOiLR+k4zEsXUjerNR0uD1AyQxyQVqXF4=; b=NGb6ecncS/wPcOcQyoT2bqg0owJ1u1eIG+V+Mx1lses78q1pP6Mm7J/DyNHsxEgX34fOiX 1JDTS/iOjCMc2yFBJMTxgKibdg89Sk3MvagTOIkxZJary/37RyRLdFE6dKS1+kT7Qo7Ip1 6nputMCWchh/dozUtxO4ZR0VRwlefpcoGQ6EQ4C3NqnBb00F1zQB2JFwSN+lkbkImwpdg8 8sWMbPaAwHWG3oYCkk7JWjAUPrEd6Qmkt/EZIwhM5q3h5b3paEzWS0+49I6go9b6mK7UyY 7dAZudfkjIkFi7339vcP292FE0DVvfhfrqZzsduCBqUBW0QZJdfCfPePSbNrMg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790008885; b=xn5PG4JRfM+FF7cUZqoNO3Wa5BGgrLua5V3VVwola+H3j3lIXgHqJn9bbwTcuMSBSPTA87 b7snwmop4sbbAOIXtfZvLnpRch7wA1qAi6vsW94k5XrlMYWMDNQDvJ7wp2Zs2UTdbWq2rS 8TRVDgEqr8cAdiOPUsbvLhLD/nw5YCyFU6v0IuaDMxZi2RxrdgUWzwQXq23L791HcK9Bh5 vLfNz0wkBA6T0nfZSUV7vpqAUjyde2L2WmnfcQ1WDO5m+G+QHnMuLj4eV8FZ//iIPHCk2y AxmFI7eV5ilAQVq84pY8U89kZIx8d2EYdufEuCYgDeW3sWqhRFdnU+tMHzWWww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790008885; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OimaqxiEApHOiLR+k4zEsXUjerNR0uD1AyQxyQVqXF4=; b=v62HawTTZtLbQvPqQUn5ukLZfnqY2EbQpNQ0n6BzUUO1HDn/dHMKVShCPeHTH4xitx9zHy b9zz/3qmHSvWL/BQdrQDBE3f+J84o17HOVPzZ2yYMsg5nTFAnta60Ns8F439WLBFkw2cgx 1NDDayGoy0NbT5cIGm5n/5u8TmrTi5j8TSz7bxsZzIeuBQMP5VKkRb3ctLjb0BDm39AXXL 6BfrS1QfwqYY1F1FVitaTWHIFipip/cSkbHBtft3du8vp2P+qpLTISkUZeh15U67CQE/P+ 0i3eLXcTBZd12surtfIcChI4lVgkMN0VBFYhZTeJ0GDj4TB0G6ofLto/5ilBSA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hpTWn4Y40zSJl for ; Mon, 21 Sep 2026 16:41:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a1fa by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 21 Sep 2026 16:41:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Hayzam Sherif From: Mark Johnston Subject: git: ce5b70657f94 - main - vmm: Fix a page wiring leak in MOVS emulation List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ce5b70657f94d2051566664d3ea7167d104803b0 Auto-Submitted: auto-generated Date: Mon, 21 Sep 2026 16:41:25 +0000 Message-Id: <6ab15e35.3a1fa.2391a2ad@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ce5b70657f94d2051566664d3ea7167d104803b0 commit ce5b70657f94d2051566664d3ea7167d104803b0 Author: Hayzam Sherif AuthorDate: 2026-09-21 16:34:08 +0000 Commit: Mark Johnston CommitDate: 2026-09-21 16:36:11 +0000 vmm: Fix a page wiring leak in MOVS emulation When emulating a MOVS from MMIO to guest RAM, the kernel's vm_copy_setup() wires the destination pages. If the subsequent MMIO read fails, emulate_movs() skips vm_copy_teardown(), leaking the page wire references acquired during setup. Run vm_copy_teardown() regardless of the MMIO read result, and only copy the value to guest memory if the read succeeds. Preserve the existing error return. This matches illumos change 13309. Reviewed by: markj Obtained from: illumos 83cd75bb2949d26e6eb38ddefc60fdeed1909643 MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59823 --- sys/amd64/vmm/vmm_instruction_emul.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sys/amd64/vmm/vmm_instruction_emul.c b/sys/amd64/vmm/vmm_instruction_emul.c index c54b6e6d0074..963da132c36b 100644 --- a/sys/amd64/vmm/vmm_instruction_emul.c +++ b/sys/amd64/vmm/vmm_instruction_emul.c @@ -858,11 +858,17 @@ emulate_movs(struct vcpu *vcpu, uint64_t gpa, struct vie *vie, * before the MMIO read is attempted. */ error = memread(vcpu, gpa, &val, opsize, arg); - if (error) - goto done; + if (error == 0) + vm_copyout(&val, copyinfo, opsize); - vm_copyout(&val, copyinfo, opsize); + /* + * Release the copy resources even if the MMIO read + * failed. + */ vm_copy_teardown(copyinfo, nitems(copyinfo)); + + if (error != 0) + goto done; } else { /* * Case (4): read from and write to mmio.