diff options
| author |   Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> | 2026-03-12 16:02:53 +0000 |
|---|---|---|
| committer |   Wei Liu <wei.liu@kernel.org> | 2026-03-13 21:11:18 +0000 |
| commit | 6922db250422a0dfee34de322f86b7a73d713d33 (patch) | |
| tree | bfa81fb9981fa73443543b3866ed62662eba7b86 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | mshv: pass struct mshv_user_mem_region by reference (diff) | |
mshv: Fix use-after-free in mshv_map_user_memory error path
In the error path of mshv_map_user_memory(), calling vfree() directly on
the region leaves the MMU notifier registered. When userspace later unmaps
the memory, the notifier fires and accesses the freed region, causing a
use-after-free and potential kernel panic.
Replace vfree() with mshv_partition_put() to properly unregister
the MMU notifier before freeing the region.
Fixes: b9a66cd5ccbb9 ("mshv: Add support for movable memory regions")
Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions