[xen master] x86/platform: fix the MTRR rollback in XENPF_add_memtype

[patchbot@xxxxxxx]

commit 0fb2c553148e84444a4df523283e7bf4811c4c6f
Author:     Yuho Choi <oss.patchbox@xxxxxxxxx>
AuthorDate: Thu Nov 5 09:48:44 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Nov 5 09:48:44 2026 +0100

    x86/platform: fix the MTRR rollback in XENPF_add_memtype
    
    If copying the result back to the caller fails, XENPF_add_memtype
    tries to undo mtrr_add_page() with mtrr_del_page(ret, 0, 0). By then
    ret holds -EFAULT, so mtrr_del_page() looks up an MTRR with base and
    size 0 and releases nothing. The register that was added, or whose
    usage count was raised, stays in use, and the caller only gets
    -EFAULT, without the register number it would need to delete it.
    
    Pass the register number saved in op->u.add_memtype.reg instead.
    
    Fixes: 8ee614278c2d ("[XEN] Fix memtype accessor domctls.")
    Signed-off-by: Yuho Choi <oss.patchbox@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/platform_hypercall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/platform_hypercall.c 
b/xen/arch/x86/platform_hypercall.c
index 6dee4922f3..0f3c791fc2 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -295,7 +295,7 @@ ret_t do_platform_op(
             ret = __copy_field_to_guest(u_xenpf_op, op, u.add_memtype) ?
                   -EFAULT : 0;
             if ( ret != 0 )
-                mtrr_del_page(ret, 0, 0);
+                mtrr_del_page(op->u.add_memtype.reg, 0, 0);
         }
         break;
 
--
generated by git-patchbot for /home/xen/git/xen.git#master