Commit 0a416ee20bcc for kernel

commit 0a416ee20bcccddf91ca5b63696a23b9d11d73aa
Author: Amit Machhiwal <amachhiw@linux.ibm.com>
Date:   Tue Sep 15 22:04:16 2026 +0530

    KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

    In kvmppc_svm_page_in(), if uv_page_in() fails after
    kvmppc_uvmem_get_page() has succeeded, the secure device page is never
    released.  kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
    allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
    KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
    refcount=1 and locks the page.  The subsequent goto out_finalize skips
    the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
    page, and none of those resources are ever reclaimed.

    Each occurrence permanently consumes one entry from the firmware-bounded
    secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
    marked as secure — making it unusable for the lifetime of the VM.

    The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
    failure correctly with unlock_page(dpage); __free_page(dpage).  Apply
    the same pattern here: unlock_page() followed by put_page(), which
    chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
    to clear the bitmap bit, free pvt, and reset the GFN state.

    Reachable whenever uv_page_in() returns an error (e.g. UV pool
    exhaustion) on any POWER9/10 + Ultravisor/PEF system.

    Fixes: ca9f4942670c ("KVM: PPC: Book3S HV: Support for running secure guests")
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
    Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
    Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/kvm/book3s_hv_uvmem.c b/arch/powerpc/kvm/book3s_hv_uvmem.c
index 5fbb95d90e99..463aef870c4e 100644
--- a/arch/powerpc/kvm/book3s_hv_uvmem.c
+++ b/arch/powerpc/kvm/book3s_hv_uvmem.c
@@ -779,8 +779,11 @@ static int kvmppc_svm_page_in(struct vm_area_struct *vma,
 		if (spage) {
 			ret = uv_page_in(kvm->arch.lpid, pfn << page_shift,
 					gpa, 0, page_shift);
-			if (ret)
+			if (ret) {
+				unlock_page(dpage);
+				put_page(dpage);
 				goto out_finalize;
+			}
 		}
 	}