On Fri, 2026-08-14 at 21:40 +0800, Ruoyu Wang wrote:
> Each sgx_encl_mm instance holds an enclave reference so the enclave
> outlives its MMU notifier. sgx_encl_mm_add() acquires that reference
> before calling __mmu_notifier_register().
>
> Notifier registration can fail while allocating subscription state or
> when mm_take_all_locks() is interrupted. In that case no notifier or
> mm_list entry takes ownership of encl_mm. The error path frees encl_mm
> but leaves the enclave reference behind, preventing the enclave and its
> resources from being released.
>
> Drop the enclave reference before freeing the unpublished encl_mm. This
> balances the acquisition without changing the successful registration
> and teardown paths.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: 2ade0d60939b ("x86/sgx: Maintain encl->refcount for each encl->mm_list
> entry")
> Signed-off-by: Ruoyu Wang <[email protected]>
Reviewed-by: Kai Huang <[email protected]>
