From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4C2D3C465 for ; Sun, 5 Jul 2026 01:40:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783215616; cv=none; b=nIaFKyNhRK9KbMNVIvhO9dAavphkHmIpg+4Nc50sHm1xnNMyldIOV4iYH++Pdrn6ASTLBzbkMvGdaMiKwli9hfLhrYCAmzx4wdZicnf/0LF3NVbuDtZp1KyWqjCVG/9CFRGZRdlKiXMMwE21UufOSTxk0yLOPCvOSEijOjAAIo0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783215616; c=relaxed/simple; bh=EYJEPXytt4pmKnn/MD3hvuVjx/RNH42xxRrH4dUNC8o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IE55N4Ae07LJ26S6Hk0UyFOpumxIFmHBS8GE7MMRDATZOXeADqsGq1/hOPLQEjjIpBG1m5dGch3SfiTfK8CSi3psD57GzoJZ9h9EKpqAUD2H3xP9OXTRALkf0vkZaL/eOPueo/BbXfMrD5AOWFqXiBqUymdwkRqopXSZ0/2VSsk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=McYgCY+3; arc=none smtp.client-ip=209.85.216.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="McYgCY+3" Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3825c406ffeso935289a91.0 for ; Sat, 04 Jul 2026 18:40:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783215613; x=1783820413; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=oPsFGUTTT7n/qqSsl80pkjMnwpBJfWNqBULhouzxndg=; b=McYgCY+3/k+U6wbt+lxn04r7dXDKDw503iWORZxNYBlBU6maqbtvjiX1CtnDJUTg+Z S5uwcx7xrJXy/pszhxXrHhgtZOBRe9OJm1lIEv3v8DwU0VT8ISccTM2T2AV1JJv70kym GP5/ywejVCAY5yxKl0fTKbGXVsO5SNs82s4BJqesY0vHu50505xLPt0Ods+4ZJK2SX8P 71/9KDLtIJQKsYc8aLoFQMx+nLc3mfvFqP58z0FMFqirciXLFmLDN3taVIULRH8PJAGt 8Upo9mF1PT/AVtmVudwlZg9v0+1KOUmNxEkL9xThSKOxQyEUjQn/9hOYk0+TIcR+P9sa CnyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783215613; x=1783820413; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=oPsFGUTTT7n/qqSsl80pkjMnwpBJfWNqBULhouzxndg=; b=dvKMwbMugQGTkPWYOC4it7KCuVio3N7kmyfBwbO1n3+Eu5+fVtSP0/BLTyDS5MyKn+ rosDUnGgwaMR45PFeDhIwOanyxs4FwIhim+FdEbhQFYS1JKPbjmX/kwYxqvsdXfL5Ymc CSyLJaBj2itH2uyPkbi3PoJxXMEgnX4/tuMY8mykdGHQfKv4slm67Jg/FE5xledGFzp/ e80xhRqz17pWUKGgMHh9XR2L0RhT8jEq/AnJBmcc4zbeXIjz3pXMJEn2R4cz7YaGKPf6 AaaQN7+jYLhSGwvJlHSk9k9rw9ZlAYForecNX8OCKyYvlRGeN4+4y+J8prq4ZTYj6kJI kt5g== X-Forwarded-Encrypted: i=1; AHgh+RrQiMcCN/wbC1r+BHlOji5Tmk/z3ZCSHTghug71oTEXhvvLrPLkmWRkvR7OSuPQ3iG5LkQLtHW5P+2GYyY=@vger.kernel.org X-Gm-Message-State: AOJu0YwyZEo4Mr7MquhYReEGipUbropJIQ8b4WNiwvgdbrJ+BxctmHoL a45tg/pez9tfvWjDrxQ7yEzy/Tlc33foOzLnZnonigehajGNDzs1beUWyzpltin00+YmVLGajh/ hHHtt5HBR X-Gm-Gg: AfdE7clFkUw54b+p2r+9Av0KVEN6RDyYuGcvlVSp2nnj2C/GKYzwUjz9R9V+GuY33GO Oc+VP/gtevcirRUPuJoYC2R4O5wCwno2B7Aofs67y7CJCvaHGD7PB1LqQl/rtl/DA+FuRn/5gV2 kU2ryTwRwtwMdUf3cUAEDCcsDOcBd+fRtbLW05rx8hY5bPVH+UZaQmYlAInpaf7YJ0xBbHzznvu k8p+Qhwjg2roJJNqwqBYSofYbX3eVra4OiUDffz3I/xkB24dper/LmvslHkLcPe0doTePBF8emS KKkbWOpAupLH4wuCKk7IYS0fhKvJA9xVgLjYJsuynUXnOTNwMKDlbpRkQb7OHESgUygOAZV0ucT NdoHxqkwc2shryKs98fZ2t0CNx0gdNlM024s1sVBhdurOBjZbsB3I5Rex1KYChpYfHev+mJNmJM s9wkMbw/NW X-Received: by 2002:a17:90a:e704:b0:367:bc89:546e with SMTP id 98e67ed59e1d1-38280e9457emr4626911a91.12.1783215613226; Sat, 04 Jul 2026 18:40:13 -0700 (PDT) Received: from p1.. ([2607:fb90:ec0d:5e36:b9f2:b9e9:da03:a2c0]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38127ae6e2bsm2945320a91.2.2026.07.04.18.40.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 18:40:12 -0700 (PDT) From: Xiang Mei To: Alex Williamson Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Auger , Li Qiang , Weiming Shi , Xiang Mei Subject: [PATCH] vfio/pci: clear vdev->msi_perm after freeing it on init failure Date: Sat, 4 Jul 2026 18:40:10 -0700 Message-ID: <20260705014010.1297885-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception Fixes: 30ea32ab1951 ("vfio/pci: Fix potential memory leak in vfio_msi_cap_len") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei --- drivers/vfio/pci/vfio_pci_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index a10ed733f0e3..9914f3ac69ae 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1272,6 +1272,7 @@ static int vfio_msi_cap_len(struct vfio_pci_core_device *vdev, u8 pos) ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); + vdev->msi_perm = NULL; return ret; } -- 2.43.0