On Fri, Aug 14, 2026 at 09:40:20PM +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
>
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
>
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list
> entry")
> Signed-off-by: Ruoyu Wang <[email protected]>
> ---
> arch/x86/kernel/cpu/sgx/encl.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
> index 3f0222d10f6e6..04fbf7e703e1e 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.c
> +++ b/arch/x86/kernel/cpu/sgx/encl.c
> @@ -866,6 +866,7 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
> mm_struct *mm)
>
> ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
> if (ret) {
> + kref_put(&encl->refcount, sgx_encl_release);
> kfree(encl_mm);
> return ret;
> }
> --
> 2.51.0
>
Reviewed-by: Jarkko Sakkinen <[email protected]>
BR, Jarkko
