From nobody Sat Jul 25 04:30:46 2026 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11020083.outbound.protection.outlook.com [52.101.201.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83B203859FA; Sat, 18 Jul 2026 12:59:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.83 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784379560; cv=fail; b=kFacvPfO78Gu9WY0YIqUygVsJSe/cdFQ1lSNuikl3V+RChi3ORcgnx4MEqI0ntX2O0O+JJFLZWHOZeEySRwWRvv0drDek/JC2R5b/biQ4OElWRoI3KG4NojXPgZ5x/T4s/beB8rerR+Pnbq/O5QA+hjcaWi8hbW0QKYh8zK3Gig= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784379560; c=relaxed/simple; bh=6ocI9MM8Xw/XZrLJi2qhqbdkLUBi3BsB3d+8UsXsn8c=; h=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version; b=jpnPVQxHjAPDMIU4JS+UE/RLjFW6+vUwJlT7U7KnM1hK6+J5AmywyFwRTKwmJ+wg1Y/YhsRPOSr5cHX/+sZ7J6Eo7YbjfggFR7RoFwLa60+OlcpwH51Nl0fbU3UIKTE5wozHL4td0kpKKoCGITdIJQsbbGBTb4xrJEf0nOSXhJQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=phil.gs; spf=pass smtp.mailfrom=phil.gs; dkim=pass (1024-bit key) header.d=NETORGFT5377951.onmicrosoft.com header.i=@NETORGFT5377951.onmicrosoft.com header.b=DvGXYnzB; arc=fail smtp.client-ip=52.101.201.83 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=phil.gs Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=phil.gs Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=NETORGFT5377951.onmicrosoft.com header.i=@NETORGFT5377951.onmicrosoft.com header.b="DvGXYnzB" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=t6wti/HiHwYj3tBV0Bg0z765AzNCPR1qpzCj7VOddPYJaxdiosU84KxQcSB+PNQumExVbP4KAkHmfDgeOoccvmKMkzkkfuocb+znRpd6isUZ9gTshs5oxGNTdXaot+ODwrNoQAh7GZyvH+R4ww2NvEqbAU4YCr3UCZL7MTnM4HI9kKigZxBcy19wryOokoo3LEdlbl5U+Z9PSYoE84HlBZ1uocouj7S8QmmOkhmwGcjy1tEV4iIHv52aP0BY98ARSjE6ZFMcDU1c+uC0DJt0SLSzwqyL4lmXOVjMKncDzuIlPAY7Rr+tzyLWG2gi6Xsty9ZgXHnukWkcsE6yl1uxAQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6ocI9MM8Xw/XZrLJi2qhqbdkLUBi3BsB3d+8UsXsn8c=; b=peTSOpL383rxuQQU7YcO9DxuPXKq2UK2JF4dvOIA/ZximiRsXzBSyUCpewNc0HPyeQGrRbr6Ka0sLZZZxM/AIwrscDCEUoadZ8qiw1TxJbHIkSVmXWWAunVjacOpT5UusZVU98HPU50M7yHbdd2sFu4FkrsSB/3A5TekVUVsRYLNacSOLl2khL/YROiPx5VkNRAcP+hMAUzALhh2JolITkRtQz3yb5iCfy9EggiIDZh4txzZPnDaMJ5ihQwdBGK+vEsPZvpNAx6uLdJRDI0mPaqFS4Bjzw/FXFSJWFXYtVh1TU26ho0Z6xieVrKktqWLtMKyDZJlLmLK6GkYz9DGVA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=phil.gs; dmarc=pass action=none header.from=phil.gs; dkim=pass header.d=phil.gs; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5377951.onmicrosoft.com; s=selector1-NETORGFT5377951-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6ocI9MM8Xw/XZrLJi2qhqbdkLUBi3BsB3d+8UsXsn8c=; b=DvGXYnzBA0yLwG0fVQbAGsqXGcqUG/Rl82C9mq1i1x0R0h23FCEmya1/VA919OrRsBlcWyA1TB6FH3IBuCGO50Mdfo3vGyHbcdUHWjjwNObFS9q0+ifqIjGV9kb0NTEcXcAY/Fq0szcKcMuZfCfiPIJcOp5wJtxUDefhtDywlwk= Received: from BY5PR04MB6472.namprd04.prod.outlook.com (2603:10b6:a03:1eb::10) by BN8PR04MB6386.namprd04.prod.outlook.com (2603:10b6:408:d9::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.14; Sat, 18 Jul 2026 12:59:17 +0000 Received: from BY5PR04MB6472.namprd04.prod.outlook.com ([fe80::3a9:9dbc:2aeb:8827]) by BY5PR04MB6472.namprd04.prod.outlook.com ([fe80::3a9:9dbc:2aeb:8827%6]) with mapi id 15.21.0223.013; Sat, 18 Jul 2026 12:59:17 +0000 From: Phil Rosenthal To: "seanjc@google.com" , "pbonzini@redhat.com" CC: "kvm@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: [PATCH] KVM: x86/mmu: Fix double-free of mmu_page_header_cache on vendor module reload Thread-Topic: [PATCH] KVM: x86/mmu: Fix double-free of mmu_page_header_cache on vendor module reload Thread-Index: AQHdFrU9BLUzBrbZrkCLVxfvABxMug== Date: Sat, 18 Jul 2026 12:59:17 +0000 Message-ID: <3FD1B35F-ECF8-476D-B2F1-6A43E6E0B641@phil.gs> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=phil.gs; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: BY5PR04MB6472:EE_|BN8PR04MB6386:EE_ x-ms-office365-filtering-correlation-id: 8e245647-9e7e-4713-388a-08dee4cc607c x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|19092799006|23010399003|1800799024|366016|38070700021|6133799003|56012099006|10067099003|7055299009|18002099003; x-microsoft-antispam-message-info: CR+L0Cf/jZaMpMpq+HWvmWKxqa00LYGgdCDNuqcj6c0ORgNt1rwoe/0XQ+SS1M833O7lK7CwaZ+IZpoyp3CySrfBUfv/9H3fjhDTcNVtwUSs2ZcPbmpN+U4OIq9vNalaVEPjWEGDesP/bPgu26hyra/QpQ0bbdQfLzjsL00cp2p7kXTUan0p3fN0AO5Un/1H/WNLFfVUxdE/7nA09F7X+fgX8ci52mN5cC8iLaXpFczmQo+k9601MfoYmsr6Og+wqnysxu17+mer3wCA0C3pQnPERdzL7AkzuwsMMaoKUksCaQSAMgceiCraD6/5eIsfAc1EiVJe5aM7FOcisRLEf0HpDTOKJjzzl8bbBhh78wjE8iLkrttTZaM/DQngEgqXk3gyprKedwiQKx4ExsqObpg9SgyfKtB2YafsA7PcH9QjKLHZw+eTBeBno2xPzpqXZcmlvIKJJ5na5xjDx40cbF8sJZylA/mm6OQm6mFxCq9B90M6bgkfXWdnbO36GQpjRdHJB/wbjpYzxszYYGeNSv5Zit0KJeTWXaJ3/wCfndKLUQJO16INDQ9qiUDuzPNmYom1QcfI8n3dbQntXWS2Vtgn/EWzIVCLaKlNEzfx54ItOhLLhiCGgMjCCNnrU9l5IxU60J7Y0WkAbLgCJ1NAG4GKc/vzDEe/LKVKevJDNMskXZFh+ZnS/NGepqbYXbkcmhGWLYi5sat1HITzF3FRbyZQKVHWx4conDm8GECmbnPmnw9Wq7XEuoG2EyKUpYCW x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR04MB6472.namprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(19092799006)(23010399003)(1800799024)(366016)(38070700021)(6133799003)(56012099006)(10067099003)(7055299009)(18002099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?B?VlI2MEpjd1pSb2xMVGc4VGg1OFhaN2J6MFArUDZ5Y0E4dU9mMG80bERrVWc4?= =?utf-8?B?K3hXOWk3ZXBxcFNiUDhZa1R2VmxXcll2b0M5VFc1YmhPZWw0QjhzVFpsRjB5?= =?utf-8?B?TGg5Y3Rxc29BdXVMWTJVSGMza3BnRjlhUmFtOFRiRWlTc2ZaOWZjSk0xYUNk?= =?utf-8?B?TjZlWFlnWTY3Ymd0eXFwYlJPOTgzNloyUUpGVmlaeU1NM0J1VUE0NlRPUjJI?= =?utf-8?B?blBiVFJ5UzdRUXlGTnRhSjlvbWdUblpseDlDOXlPcmVXdkFNUjdEQW13SnRa?= =?utf-8?B?bVFQN1dsS21jT0JoRTdwOEN4elg5ZXppZzB1dS80eTlCMjhrVW95KzBpejlL?= =?utf-8?B?ZXZhSUpwQ09PYmpraTF5eXozekJBRUp0ZEgzcW1JQ3pLUUM4QlBwQkY5b1Ax?= =?utf-8?B?enpZQ0xCZjVhMmtxWHdodjFrVmcxaFRreER2MEhpRGthTHppYlQzS2JlRDBu?= =?utf-8?B?Vk1WWFQ5WUJRdERXQ3B2RWtsdTd2QU1haDdqVmVVVFdua0FVR1hHZ1phNXpu?= =?utf-8?B?RVNUL2d1YVgyU0VVWUIxWEdhNHpIZVBUWlkxbnRXQnhuZEF2TnZmbFZ5QTlU?= =?utf-8?B?dU5WTHE3L3dBaWZJczVPVm5XdTVlUTNndTA3OHF5UUxYTEh5Q3AvTWhRdnBa?= =?utf-8?B?N2lXdThDV09LVE4rY0RPUnJTcHJWTXV5OE9JRnlSU0tRVlJMSlQ0bW5qR0dR?= =?utf-8?B?MEdjMkhvUkVHRG1vOTVPNUI3VXpLTm1UK1duNE9ublhObXRDeHl6ck04cW5v?= =?utf-8?B?RGNETHBOS0NoMmh4a21POFBXckJsWk1ndHZQR0x3dHM0ZTdsaDU0TG45TFRn?= =?utf-8?B?MGQvajZOZWdaSlMyRmtEZnRLVUljZTd2REVoVFNQV2RqeGhsKzFvRkFjQ29S?= =?utf-8?B?NDd0K2pQYjZ2a3ExL3JTSUMvOEhjdktqZkhjRXJYelRxdGRuT3R0cC9FWFRC?= =?utf-8?B?RitoOHUwMjA3bTNISkh6dE9DNHFEMXFVQjRzbWVvV3VrWThBdEF6Zy9qNHBL?= =?utf-8?B?TWJKYllRYXhsWHhWQ1ppVUJpcXU4Q09zRWtuQm15SjlSSGxRT0tzYWNaZzI5?= =?utf-8?B?L2hGeVlCQTlGL21LQkd2N1ZIR0FRcjZ5eGg3NFdITUNkbEVFaXRBdEFmdTJI?= =?utf-8?B?Z3c5VHlTZHhVTVpEQUNEU3l5UzJsOXNUeDhoeVdwbmxHcWgzNGRpQTB6b2sw?= =?utf-8?B?YkNwS1ZuMTMyRXVVdWdiOWJGU3RjQjEwL00yaVFXdmJxNGFLeEQ3WTNsNldv?= =?utf-8?B?aFkydUdob3FIWnVMR0pWSVNscUd2RnB1R3dvVDlKZkZQOEE5NGNyNjNSZXRn?= =?utf-8?B?V3VYZ2kxQmFwbFRDcnNsS2lpc3Y2OU9wZHFoWS9ySnJEeE15dkpVTGV3ajZU?= =?utf-8?B?M2dYSVhIcU92TnlNWUtjQ0libVhnMzNYc3ZkL3dPa0RIWFRzNlVGOWVOc3Iv?= =?utf-8?B?ZFJFbU40MkhLQklqTHQra3JlbDNYdzkxU1RBZzc1eTUzekVUWGlkK3hYaXFF?= =?utf-8?B?MEE0TTQ4L3JwTGgyZkplUjdmYUQ0ekNNTGhWVTM0SVMyUk5IbWtGTzJ5NTBP?= =?utf-8?B?SjcxdjJaQ3VXZjZoTjdUK1BJMm1DMjE3eXBYbEdRRTdoQnZmMWxpWlQ5K0NN?= =?utf-8?B?L3psL1QvYTBYZU5JOVBUejRGeWFtYkQxUmlNVkU2MUpOWHlsZlRtTnJnaXRk?= =?utf-8?B?cnQwb3dadnMwZlNwVmE5RHk3WjJKZ1lsZDRscmNRRW9yeVI2R0FEczVGcXdl?= =?utf-8?B?OWFwYXlXeUNldHBUanllUFdUMnRkcTVGL2FZdUg3U3J1dFlWdlJiNmljUFdk?= =?utf-8?B?cjdBMGlKaTdCaEw3SlFWaVl5WFJvZk5VWWRyQjYwU0Y1TWtYanJGcldOQm5R?= =?utf-8?B?WHFkUFJieVdoTXRJb2FReVNsSW0vOVJpMlBveUZvS29HdnFVQUNiN3owckNP?= =?utf-8?B?a0JESUlMVzAyMk1nd3c3ZmdKQTBOOFRpenFTK0JPNHJxcUdOZ25PKzErM3lF?= =?utf-8?B?cmRxcjdCQ0RsKzg2amFlMUNTNGtXelBCMmVncTRaVldKNmo4NWlkSjNBbWRm?= =?utf-8?B?YkR2QVBaMTJ6TTBnTXRYbGwrN1ZKZ0l4Q3crb3ZOZWFGTFZZYVZoMnZHVE9I?= =?utf-8?B?SG1iRTJ6K25tVFA1UjN5UmdQRnBUSE9heFFUOUg2TlRINGd2bWhaN0RXdDJa?= =?utf-8?B?WkU0cWRZVVZpQmJPSk5obkJNczFBK1d5ay9qRlhXazVPVkdhUzFvQ3dKU1I0?= =?utf-8?B?VThSQTJuU2F5Zm5lSHVIcEg0dFFKaGFBVHhZc0hNTzVkT3hGek1iUFNZT3RM?= =?utf-8?Q?P+gw+bzHtF0hr1yguc?= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: phil.gs X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR04MB6472.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8e245647-9e7e-4713-388a-08dee4cc607c X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jul 2026 12:59:17.6159 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 47d4f979-ea6f-4fcb-aea9-39371d64bc6b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 2WZQ68XDYozilybstKGpIXX5a7NeTa05SpsYD2CrVdu0ZYTTL3U72kTqHQVfnyBo X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR04MB6386 mmu_destroy_caches() frees pte_list_desc_cache and mmu_page_header_cache but does not set the pointers to NULL. Because they are static globals in the always-resident kvm.ko, they survive a vendor module unload/reload cycle. If a reload of kvm_intel/kvm_amd fails because the first kmem_cache allocation returns NULL (e.g., under memory pressure), the error path calls mmu_destroy_caches() again. On that second call, mmu_page_header_cache still points to the already-freed cache, resulting in a double-free. Concrete trigger: 1. Load kvm.ko and vendor module (both caches created). 2. Unload vendor module [leave kvm.ko loaded] (caches freed, pointers lef= t dangling). 3. Reload vendor module; first cache creation fails =E2=86=92 error path double-frees mmu_page_header_cache. Fix by resetting both pointers to NULL immediately after destroying the caches, making the cleanup idempotent. The bug was verified on a KASAN-enabled kernel by instrumenting kvm_mmu_vendor_module_init() to force the first allocation to fail on a second load, simulating OOM; KASAN reported: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x1ba/0x1e0= [kvm] ... Allocated by task 11693: <- first load Freed by task 11696: <- previous unload Signed-off-by: Phil Rosenthal Tested-by: Phil Rosenthal --- arch/x86/kvm/mmu/mmu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 234d0a95abf5..ec49ce98a449 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -7574,7 +7574,9 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u= 64 gen) static void mmu_destroy_caches(void) { kmem_cache_destroy(pte_list_desc_cache); + pte_list_desc_cache =3D NULL; kmem_cache_destroy(mmu_page_header_cache); + mmu_page_header_cache =3D NULL; } static void kvm_wake_nx_recovery_thread(struct kvm *kvm) -- 2.47.3