From: Gal Pressman Date: Wed, 25 Feb 2026 14:50:50 +0000 (+0200) Subject: KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter X-Git-Tag: v7.1-rc1~118^2~5^2~2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1450ab08108ccd825c8f9362475fadfc187942fc;p=thirdparty%2Fkernel%2Flinux.git KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter The nx_huge_pages parameter is stored as an int (initialized to -1 to indicate auto mode), but get_nx_huge_pages() calls param_get_bool() which expects a bool pointer. This causes UBSAN to report "load of value 255 is not a valid value for type '_Bool'" when the parameter is read via sysfs during a narrow time window. The issue occurs during module load: the module parameter is registered and its sysfs file becomes readable before the kvm_mmu_x86_module_init() function runs: 1. Module load begins, static variable initialized to -1 2. mod_sysfs_setup() creates /sys/module/kvm/parameters/nx_huge_pages 3. (Parameter readable, value = -1) 4. do_init_module() runs kvm_x86_init() 5. kvm_mmu_x86_module_init() resolves -1 to bool If userspace (e.g., sos report) reads the parameter during step 3, param_get_bool() dereferences the int as a bool, triggering the UBSAN warning. Fix that by properly reading and converting the -1 value into an 'auto' string. Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation") Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260225145050.2350278-3-gal@nvidia.com Signed-off-by: Sean Christopherson --- diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index b922a8b000577..733c1d5671cd5 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -7487,9 +7487,14 @@ static void kvm_wake_nx_recovery_thread(struct kvm *kvm) static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp) { + int val = *(int *)kp->arg; + if (nx_hugepage_mitigation_hard_disabled) return sysfs_emit(buffer, "never\n"); + if (val == -1) + return sysfs_emit(buffer, "auto\n"); + return param_get_bool(buffer, kp); }