From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32E4F38A73E for ; Tue, 10 Feb 2026 17:41:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770745282; cv=none; b=bd94eQnPVHTl+ABTTz7PRdDAMfbGWTGx4YbwygOgvGls1rEF5FMUdvLOZtqAJxCo3k4TDs56W2owU0NcuxSSNt4QdVEQs8Np/zeOjdsRDgCmAKHxdDIU5khRy8/fJ+KUpJRFQvQLq9yxkS+Md6cVsDhC7Ydq1oD07zZ5e1mYv68= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770745282; c=relaxed/simple; bh=ZQsoWUT9FMX4cjjVwzRilFpIIYG2IX61f548cWJWlBA=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=BfgmyFEDGxu+VxBG+zwLtxWpN4Eh3fZPzxfaJwW0sqtEoVVxluPENKkQXEBYj8nmpd94Zv9wDhRK1d5pp7mTMq6fzBf3q9J/Fe8HKsWem/0UKo23e6s7bD2vVDkZeEXMFW6+jvAOyKRLFA+49Hx9pmW6e7kkZ2xWVucgyo8OLSM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=gfpfvw66; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=HFnz1K7b; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="gfpfvw66"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="HFnz1K7b" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770745279; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Yo5EtKyXczJYQnTQtXSt9wnj+YOsv5TNLYHtToa8jgw=; b=gfpfvw6688JmPJAUuYYxpJ0IXzVadilbmN+bfR0uvM3SVc5C2Dg6kjlVxBKtM48oExizTX NygrjtqebAfwDvg2iI8yWv7Rdgx1bS7KiPAWDU+TOSB381YVyMmrMbj2YM+nCRKwOd7ojE jmWP/AyBLWVpBgSy1xxL+WzwSJtst/Y= Received: from mail-ej1-f70.google.com (mail-ej1-f70.google.com [209.85.218.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-652-4yOnC2ULPtWS2_AzBvXD3Q-1; Tue, 10 Feb 2026 12:41:17 -0500 X-MC-Unique: 4yOnC2ULPtWS2_AzBvXD3Q-1 X-Mimecast-MFC-AGG-ID: 4yOnC2ULPtWS2_AzBvXD3Q_1770745277 Received: by mail-ej1-f70.google.com with SMTP id a640c23a62f3a-b801784f406so588499566b.0 for ; Tue, 10 Feb 2026 09:41:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1770745277; x=1771350077; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Yo5EtKyXczJYQnTQtXSt9wnj+YOsv5TNLYHtToa8jgw=; b=HFnz1K7bXyTuJPRiX3vDerl/cTLm3gIIllp4NB8l3OQP3rz5bocRiY+ZfVTu8JvYSy xDZoQuOUqvRK5k6thQp/VFejj3DTrPPesGaDaQDDoKpPd8btIn8IUpFZVoeZZgTxuBGl uE/BgLFB/+4HUXVUTKThmKbTlCBXpzlNTAz8KTuhbKcIbB5d5LoThwFMRilW5I+UbSSw Ep+77S1n7h7CEY9DK0NMc2I/UxBP3m8FhdUDStLCKcO9jggL62+KSPNPN32hhKr14uSE 2hBsq70kVEsNGdTNeg/PxB+Hr966RAwE/JZT5RSNMC/++reKSPXmbYKpYullu8dz8Yy/ LQCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770745277; x=1771350077; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Yo5EtKyXczJYQnTQtXSt9wnj+YOsv5TNLYHtToa8jgw=; b=s3t7yqGiDpz2fFJVljUyGbV75h/suA3XpE5x1nhU13+Eh/vGu4M7eEJkAonal5+2Cg dpZ8rRUEr8pObJpwlSIKwGeIRkRecypDaNRdOUqJ8RpBdiggzSEgYxHGI7UfGZVS1qbZ 13nlMz4nBAwGCkX1HbDZqf2RIfd6p7Vy2aGJhCEO6G3v2TxfGNLnv2RENSouXlXAmINj GrjCsPfZLZDPw+8eJbXdXc226vpXwj+eXRFtsmlJKZLK8TqseBKppgcydD8ABuR0ZBdy O+ucr0LhSoxGrNkSJI0l4M0C/3okQea37pwgjb43v/cTDjTnpscf3SLp3+hPGoYh28UV HxVQ== X-Forwarded-Encrypted: i=1; AJvYcCWnfQ5JCxDGfQ9+f9iEYJZqMqJftNkV4/95+1PcqQRnVNEmNzPHPr472fOPb5+IcOlPRu3bHEAMT7Fkams=@vger.kernel.org X-Gm-Message-State: AOJu0YxtcsfT5Pc5IlWvf/QaYSC2o+/QtAraEAe1T1JiTIBY4/qhWSG8 WlkFAkd1kSj6CTBP6LcOdnscGchwXeojzG2Ze0TFcNY0qSymB73FoUQWo13dQCX+NvZMnkriQGp GtZBaWA0uokkj2adykqXqSYdvQPx6VZwrWTWnu8mBWobeIPlSoJ/xepHFZ+WLv/acXg== X-Gm-Gg: AZuq6aL9UNGmZ9qIiSsqjrEhz37RpKIqoMDOQ9WOYCgrnI8dP7V6iSyoK/ZIExjUOdZ XczcxaY/TMSMjoOwNzihrH1nCAX145mBMKFa22+uM/ZiZJA+ZfVWf1VY3lE7DYNEWX7Aam4KH5U +3VoHkESZWrFSKZBp8qyuQMuEbAbVtzyDelLqnpfbRlraeWm6wocTiYm3o5DmbOgFp8HvErc77h ZpgaAWefzDWsvxGeiXTZAAUZ2X/XbXl/+NweHi2sr4Cy9kZU2yMi6aZCIfOAuW5/cGTdkeYcIzs K+C0US6tCuOKpd3qRoPwJ9g7SFbSKnk4A0ddHTxPXlUjgaCLY2zR5MrumTPGStLJWnqYURiwaXD 1yRT3VWZNkdnqsYkIJ82wHBzFfchDLILFOvAZmLRhUarzpNOfx5C+Hs1ljkdryQv4ULCRJTCR0S YtfoRap2/2Q1VWyLEPnTXp3jdDuA== X-Received: by 2002:a17:907:da9:b0:b8e:b366:58c1 with SMTP id a640c23a62f3a-b8f546a8f99mr160655766b.49.1770745276630; Tue, 10 Feb 2026 09:41:16 -0800 (PST) X-Received: by 2002:a17:907:da9:b0:b8e:b366:58c1 with SMTP id a640c23a62f3a-b8f546a8f99mr160654766b.49.1770745276183; Tue, 10 Feb 2026 09:41:16 -0800 (PST) Received: from [192.168.10.81] ([151.61.26.160]) by smtp.googlemail.com with ESMTPSA id a640c23a62f3a-b8edae6f106sm540183566b.65.2026.02.10.09.41.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 10 Feb 2026 09:41:15 -0800 (PST) Message-ID: <32cbecce-5635-42b1-9095-b5ae6443384e@redhat.com> Date: Tue, 10 Feb 2026 18:41:12 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [BUG REPORT] USE_AFTER_FREE in complete_emulated_mmio found by KASAN/Syzkaller fuzz test (v5.10.0) To: Sean Christopherson Cc: Zhangjiaji , "kvm@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "Wangqinxiao (Tom)" , zhangyashu , "wangyanan (Y)" References: <369eaaa2b3c1425c85e8477066391bc7@huawei.com> <5f3e0ca5-cf60-4f07-bbc6-663b04192c49@redhat.com> From: Paolo Bonzini Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2/10/26 15:35, Sean Christopherson wrote: > On Tue, Feb 10, 2026, Paolo Bonzini wrote: >> >>> I've analyzed the Syzkaller output and the complete_emulated_mmio() code path. >>> The buggy address is created in em_enter(), where it passes its local variable `ulong rbp` to emulate_push(), finally ends in emulator_read_write_onepage() putting the address into vcpu->mmio_fragments[].data . >>> The bug happens when kvm guest executes an "enter" instruction, and top of the stack crosses the mem page. >>> In that case, the em_enter() function cannot complete the instruction within itself, but leave the rest data (which is in the other page) to complete_emulated_mmio(). >>> When complete_emulated_mmio() starts, em_enter() has exited, so local variable `ulong rbp` is also released. >>> Now complete_emulated_mmio() trys to access vcpu->mmio_fragments[].data , and the bug happened. >>> >>> any idea? >> >> Ouch, the bug is certainly legit. The easiest way to fix it is something >> like this: >> >> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c >> index c8e292e9a24d..1c8698139dd5 100644 >> --- a/arch/x86/kvm/emulate.c >> +++ b/arch/x86/kvm/emulate.c >> @@ -1905,7 +1905,7 @@ static int em_enter(struct x86_emulate_ctxt *ctxt) >> rbp = reg_read(ctxt, VCPU_REGS_RBP); >> rc = emulate_push(ctxt, &rbp, stack_size(ctxt)); >> if (rc != X86EMUL_CONTINUE) >> - return rc; >> + return X86EMUL_UNHANDLEABLE; > > This won't do anything, rc == X86EMUL_CONTINUE when MMIO is needed. Yeah, I was thinking of X86EMUL_IO_NEEDED but that's only for reads. Paolo