Re: Re: [BUG REPORT] USE_AFTER_FREE in complete_emulated_mmio found by KASAN/Syzkaller fuzz test (v5.10.0)

[Sean Christopherson <seanjc@google.com>]

On Tue, Feb 10, 2026, Zhangjiaji wrote:
> > I think there's a not-completely-awful solution buried in this gigantic cesspool.
> > The only time KVM uses on-stack variables is for qword or smaller accesses, i.e.
> > 8 bytes in size or less.  For larger fragments, e.g. AVX to/from MMIO, the target
> > value will always be an operand in the emulator context.  And so rather than
> > disallow stack variables, for "small" fragments, we can rework the handling to
> > copy the value to/from each fragment on-demand instead of stashing a pointer to
> > the value.
> 
> Since we can store the frag->val in struct kvm_mmio_fragment,
> why not just point frag->data to it? This Way we can save a lot code about
> (frag->data == NULL).

It's not quite that simple, because we need to handle reads as well.

> Though this patch will block any read-into-stack calls, we can add a special path
> in function emulator_read_write handling feasible read-into-stack calls -- the
> target is released just after emulator_read_write returns.
> 
> ---
>  arch/x86/kvm/x86.c       | 9 ++++++++-
>  include/linux/kvm_host.h | 3 ++-
>  2 files changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 72d37c8930ad..12d53d441a39 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -8197,7 +8197,14 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
>  	WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
>  	frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
>  	frag->gpa = gpa;
> -	frag->data = val;
> +	if (bytes > 8u || ! write) {
> +		if (WARN_ON_ONCE(object_is_on_stack(val)))

This is user-triggerable, e.g. em_popa(), em_pop_sreg(), emulate_iret_real(),
em_ret_near_imm(), em_ret_far(), and em_ret().

That said, I do like redirecting frag->data to &frag->val instead of nullifying
the pointer.  If the change to tracking head+tail is isolated as a prep commit,
the diff isn't actually that scary (see below).  Combined with a reworked loop
for read_mmio_fragment() to make it easier to follow (still need to add comments),
fixing this isn't as insane as I originally worried.

  static int read_mmio_fragment(struct kvm_vcpu *vcpu, void *val, int bytes)
  {
  	int *head = &vcpu->mmio_head_fragment;
  	int tail = vcpu->mmio_tail_fragment;
  	struct kvm_mmio_fragment *frag;
  
  	if (vcpu->mmio_head_fragment >= vcpu->mmio_tail_fragment)
  		return 0;
  
  	if (WARN_ON_ONCE(tail > vcpu->mmio_nr_fragments ||
  			 tail > ARRAY_SIZE(vcpu->mmio_fragments)))
  		return 0;
  
  	for ( ; *head < tail; ++(*head)) {
  		frag = &vcpu->mmio_fragments[*head];
  		if (WARN_ON_ONCE(bytes < frag->len))
  			break;
  
  		if (frag->data == &frag->val)
  			memcpy(val, frag->data, frag->len);
  
  		val += frag->len;
  		bytes -= frag->len;
  	}
  
  	trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes, frag->gpa, val);
  	return 1;
  }

I'll put together a series, there are a pile of cleanups that can be done, and
I want to comment the snot out of all of this because every time I end up in this
code I have to re-learn the subtleties.

---
 arch/x86/kvm/x86.c       | 28 +++++++++++++++++++++++-----
 include/linux/kvm_host.h |  3 ++-
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8f698d68d85e..5886f082b5d6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8138,6 +8138,9 @@ static int read_mmio_fragment(struct kvm_vcpu *vcpu, void *val, int bytes)
 		if (WARN_ON_ONCE(bytes < frag->len))
 			break;
 
+		if (frag->data == &frag->val)
+			memcpy(val, frag->data, frag->len);
+
 		val += frag->len;
 		bytes -= frag->len;
 	}
@@ -8240,7 +8243,14 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
 	WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
 	frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
 	frag->gpa = gpa;
-	frag->data = val;
+	if (bytes > 8u) {
+		frag->data = val;
+	} else {
+		frag->val = 0;
+		frag->data = &frag->val;
+		if (write)
+			memcpy(&frag->val, val, bytes);
+	}
 	frag->len = bytes;
 	return X86EMUL_CONTINUE;
 }
@@ -8255,6 +8265,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
 	gpa_t gpa;
 	int rc;
 
+	if (WARN_ON_ONCE(bytes > 8u && object_is_on_stack(val)))
+		return X86EMUL_UNHANDLEABLE;
+
 	if (ops->read_mmio_fragment &&
 	    ops->read_mmio_fragment(vcpu, val, bytes))
 		return X86EMUL_CONTINUE;
@@ -11863,6 +11876,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
 		frag++;
 		vcpu->mmio_tail_fragment++;
 	} else {
+		if (WARN_ON_ONCE(frag->data == &frag->val))
+			return -EIO;
+
 		/* Go forward to the next mmio piece. */
 		frag->data += len;
 		frag->gpa += len;
@@ -14291,8 +14307,10 @@ static int complete_sev_es_emulated_mmio(struct kvm_vcpu *vcpu)
 		vcpu->mmio_needed = 0;
 		vcpu->mmio_tail_fragment = 0;
 
-		// VMG change, at this point, we're always done
-		// RIP has already been advanced
+		/*
+		 * All done, as frag->data always points at the GHCB scratch
+		 * area and VMGEXIT is trap-like (RIP is advanced by hardware).
+		 */
 		return 1;
 	}
 
@@ -14315,7 +14333,7 @@ int kvm_sev_es_mmio_write(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
 	int handled;
 	struct kvm_mmio_fragment *frag;
 
-	if (!data)
+	if (!data || WARN_ON_ONCE(object_is_on_stack(data)))
 		return -EINVAL;
 
 	handled = write_emultor.read_write_mmio(vcpu, gpa, bytes, data);
@@ -14355,7 +14373,7 @@ int kvm_sev_es_mmio_read(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
 	int handled;
 	struct kvm_mmio_fragment *frag;
 
-	if (!data)
+	if (!data || WARN_ON_ONCE(object_is_on_stack(data)))
 		return -EINVAL;
 
 	handled = read_emultor.read_write_mmio(vcpu, gpa, bytes, data);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 919682c6faeb..be4b9de5b8c9 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -320,7 +320,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
 struct kvm_mmio_fragment {
 	gpa_t gpa;
 	void *data;
-	unsigned len;
+	u64 val;
+	unsigned int len;
 };
 
 struct kvm_vcpu {
--