From: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Date: Thu, 12 Mar 2026 16:02:53 +0000 (+0000)
Subject: mshv: Fix use-after-free in mshv_map_user_memory error path
X-Git-Tag: v7.0-rc5~26^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6922db250422a0dfee34de322f86b7a73d713d33;p=thirdparty%2Fkernel%2Flinux.git

mshv: Fix use-after-free in mshv_map_user_memory error path

In the error path of mshv_map_user_memory(), calling vfree() directly on
the region leaves the MMU notifier registered. When userspace later unmaps
the memory, the notifier fires and accesses the freed region, causing a
use-after-free and potential kernel panic.

Replace vfree() with mshv_partition_put() to properly unregister
the MMU notifier before freeing the region.

Fixes: b9a66cd5ccbb9 ("mshv: Add support for movable memory regions")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
---

diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index e281311b6a9d..6f42423f7faa 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -1347,7 +1347,7 @@ mshv_map_user_memory(struct mshv_partition *partition,
 	return 0;
 
 errout:
-	vfree(region);
+	mshv_region_put(region);
 	return ret;
 }