]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
mshv: Fix use-after-free in mshv_map_user_memory error path
authorStanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Thu, 12 Mar 2026 16:02:53 +0000 (16:02 +0000)
committerWei Liu <wei.liu@kernel.org>
Fri, 13 Mar 2026 21:11:18 +0000 (21:11 +0000)
commit6922db250422a0dfee34de322f86b7a73d713d33
treebfa81fb9981fa73443543b3866ed62662eba7b86
parent0fc773b0e4c1d9fe7cbf56d4df08d7bf90b58fb2
mshv: Fix use-after-free in mshv_map_user_memory error path

In the error path of mshv_map_user_memory(), calling vfree() directly on
the region leaves the MMU notifier registered. When userspace later unmaps
the memory, the notifier fires and accesses the freed region, causing a
use-after-free and potential kernel panic.

Replace vfree() with mshv_partition_put() to properly unregister
the MMU notifier before freeing the region.

Fixes: b9a66cd5ccbb9 ("mshv: Add support for movable memory regions")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
drivers/hv/mshv_root_main.c