[PATCH 5/5] DO NOT MERGE: KVM: selftests: Reproducer for arm64 double-free

James Houghton
2026-05-04T22:42:55Z

Add a delay and a counter for the split_page_cache double-free to
reliably demonstrate the race. Please see the cover letter and the arm64
fix patch for more information.

The selftest is partially written by Gemini.

Assisted-by: Gemini:gemini-3-flash-preview
Not-signed-off-by: James Houghton <jthoughton@google.com>
---
arch/arm64/include/asm/kvm_host.h | 1 +
arch/arm64/kvm/mmu.c | 16 +++
tools/testing/selftests/kvm/Makefile.kvm | 1 +
.../testing/selftests/kvm/transfer_fd_test.c | 129 ++++++++++++++++++
4 files changed, 147 insertions(+)
create mode 100644 tools/testing/selftests/kvm/transfer_fd_test.c

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 65eead8362e0..5072fc2e2eb8 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -192,6 +192,7 @@ struct kvm_s2_mmu {
* Protected by kvm->slots_lock.
*/
struct kvm_mmu_memory_cache split_page_cache;
+ int is_freeing;
uint64_t split_page_chunk_size;

struct kvm_arch *arch;
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 4bab407d43bb..fa05900a5124 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1004,6 +1004,8 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t
mmu->split_page_chunk_size = KVM_ARM_EAGER_SPLIT_CHUNK_SIZE_DEFAULT;
mmu->split_page_cache.gfp_zero = __GFP_ZERO;

+ mmu->is_freeing = 0;
+
mmu->pgd_phys = __pa(pgt->pgd);

if (kvm_is_nested_s2_mmu(kvm, mmu))
@@ -1021,10 +1023,24 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t

void kvm_uninit_stage2_mmu(struct kvm *kvm)
{
+ int is_freeing;
+ ktime_t s;
+
lockdep_assert_held_write(&kvm->mmu_lock);

kvm_free_stage2_pgd_locked(&kvm->arch.mmu);
+
+ is_freeing = ++kvm->arch.mmu.is_freeing;
+ s = ktime_get();
+
+ /* Sleep for 10ms */
+ while (ktime_to_ns(ktime_get()) - ktime_to_ns(s) < 1E7) {}
+
+ WARN(is_freeing > 1, "detected double-free of split page cache");
+
kvm_mmu_free_memory_cache(&kvm->arch.mmu.split_page_cache);
+
+ kvm->arch.mmu.is_freeing--;
}

static void stage2_unmap_memslot(struct kvm *kvm,
diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 9118a5a51b89..53a1b9c7bff8 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -66,6 +66,7 @@ TEST_GEN_PROGS_COMMON += kvm_page_table_test
TEST_GEN_PROGS_COMMON += set_memory_region_test
TEST_GEN_PROGS_COMMON += memslot_modification_stress_test
TEST_GEN_PROGS_COMMON += memslot_perf_test
+TEST_GEN_PROGS_COMMON += transfer_fd_test

# Compiled test targets
TEST_GEN_PROGS_x86 = $(TEST_GEN_PROGS_COMMON)
diff --git a/tools/testing/selftests/kvm/transfer_fd_test.c b/tools/testing/selftests/kvm/transfer_fd_test.c
new file mode 100644
index 000000000000..ff2adff9954b
--- /dev/null
+++ b/tools/testing/selftests/kvm/transfer_fd_test.c
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Test VM file descriptor transfer via Unix Domain Sockets.
+ */
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <errno.h>
+
+#include "test_util.h"
+#include "kvm_util.h"
+
+static void send_fd(int sock, int fd)
+{
+ struct msghdr msg = {0};
+ struct cmsghdr *cmsg;
+ char buf[CMSG_SPACE(sizeof(int))];
+ struct iovec io = {
+ .iov_base = "a",
+ .iov_len = 1,
+ };
+
+ msg.msg_iov = &io;
+ msg.msg_iovlen = 1;
+ msg.msg_control = buf;
+ msg.msg_controllen = sizeof(buf);
+
+ cmsg = CMSG_FIRSTHDR(&msg);
+ cmsg->cmsg_level = SOL_SOCKET;
+ cmsg->cmsg_type = SCM_RIGHTS;
+ cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+
+ *((int *)CMSG_DATA(cmsg)) = fd;
+
+ TEST_ASSERT(sendmsg(sock, &msg, 0) == 1, "sendmsg failed, errno: %d", errno);
+}
+
+static int recv_fd(int sock)
+{
+ struct msghdr msg = {0};
+ struct cmsghdr *cmsg;
+ char buf[CMSG_SPACE(sizeof(int))];
+ char dummy;
+ struct iovec io = {
+ .iov_base = &dummy,
+ .iov_len = 1,
+ };
+ int fd;
+
+ msg.msg_iov = &io;
+ msg.msg_iovlen = 1;
+ msg.msg_control = buf;
+ msg.msg_controllen = sizeof(buf);
+
+ TEST_ASSERT(recvmsg(sock, &msg, 0) == 1, "recvmsg failed, errno: %d", errno);
+
+ cmsg = CMSG_FIRSTHDR(&msg);
+ TEST_ASSERT(cmsg && cmsg->cmsg_level == SOL_SOCKET &&
+ cmsg->cmsg_type == SCM_RIGHTS, "No FD received");
+
+ fd = *((int *)CMSG_DATA(cmsg));
+ return fd;
+}
+
+int main(int argc, char **argv)
+{
+ pthread_barrierattr_t attr;
+ pthread_barrier_t *barrier;
+ int socks[2];
+ pid_t pid;
+ int ret;
+
+ barrier = mmap(NULL, sizeof(*barrier), PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ TEST_ASSERT(barrier != MAP_FAILED, "mmap failed, errno: %d", errno);
+
+ ret = pthread_barrierattr_init(&attr);
+ TEST_ASSERT(!ret, "pthread_barrierattr_init failed, ret: %d", ret);
+
+ ret = pthread_barrierattr_setpshared(&attr, PTHREAD_PROCESS_SHARED);
+ TEST_ASSERT(!ret, "pthread_barrierattr_setpshared failed, ret: %d", ret);
+
+ ret = pthread_barrier_init(barrier, &attr, 2);
+ TEST_ASSERT(!ret, "pthread_barrier_init failed, ret: %d", ret);
+
+ ret = socketpair(AF_UNIX, SOCK_STREAM, 0, socks);
+ TEST_ASSERT(ret == 0, "socketpair failed, errno: %d", errno);
+
+ pid = fork();
+ TEST_ASSERT(pid >= 0, "fork failed, errno: %d", errno);
+
+ if (pid > 0) {
+ struct kvm_vm *vm;
+
+ close(socks[1]);
+
+ vm = vm_create_barebones();
+
+ send_fd(socks[0], vm->fd);
+ close(socks[0]);
+
+ /* Drop *ALL* refs to this VM. */
+ close(vm->fd);
+ close(vm->kvm_fd);
+ if (vm->stats.fd >= 0)
+ close(vm->stats.fd);
+
+ pthread_barrier_wait(barrier);
+
+ /* Trigger the exit_mm() side of the race. */
+ _exit(0);
+ } else {
+ int vm_fd;
+
+ close(socks[0]);
+
+ vm_fd = recv_fd(socks[1]);
+ close(socks[1]);
+
+ pthread_barrier_wait(barrier);
+
+ /* Drop the final ref of the VM, triggering the kvm_destroy_vm()
+ * side of the race. */
+ close(vm_fd);
+ }
+
+ return 0;
+}
--
2.54.0.545.g6539524ca2-goog