Re: [PATCH] KVM: pfncache: track all MMU notifier invalidations

[Sean Christopherson]

+David W

On Mon, Aug 10, 2026, David Lee wrote:
> From: Kyle Zeng <kylebot@xxxxxxxxxx>
> 
> There is a race condition in KVM's gfn-to-pfn cache refresh and MMU
> notifier handling. An HVA-backed cache can publish a stale PFN and
> kernel virtual address after the corresponding userspace mapping has
> been invalidated. The Xen shared-info HVA interface immediately reads
> and writes through that stale address, resulting in a host-kernel
> use-after-free.
> 
> The cache refresh path in virt/kvm/pfncache.c drops gpc->lock while
> resolving and mapping an HVA. It uses mn_active_invalidate_count and
> mmu_invalidate_seq to detect an MMU notifier interval that overlaps
> this unlocked window. However, mmu_invalidate_seq is advanced only
> when the invalidated HVA overlaps a KVM memslot. HVA-backed caches are
> explicitly allowed to refer to memory outside all memslots. If such an
> invalidation starts and finishes while gpc->valid is false, the active
> count returns to zero without a sequence change and the refresh accepts
> a stale PFN.
> 
> An unprivileged process with access to /dev/kvm can reach this path with
> KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA. KASAN-detected use-after-free in
> kvm_xen_shared_info_init(). The affected function reads and writes Xen
> wall-clock fields through the stale mapping, so the issue can cause a
> host-kernel crash and memory corruption.
> 
> The attached KASAN output confirms:
> 
>   BUG: KASAN: use-after-free in kvm_xen_shared_info_init+0x344/0x3d0 [kvm]
>   Read of size 4 at addr ffff888046000900 by task poc/1266
> 
> Add a notifier-specific sequence that advances for every completed
> invalidate interval before mn_active_invalidate_count is decremented,
> and use that sequence for pfncache retry. The existing barrier pairing
> then guarantees refresh observes either an active invalidation or a
> sequence change.
> 
> Fixes: 721f5b0dda78 ("KVM: pfncache: allow a cache to be activated with a fixed (userspace) HVA")
> Cc: stable@xxxxxxxxxxxxxxx # 6.9+
> Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> Co-developed-by: David Lee <david.lee@xxxxxxxxxxxxxxx>
> Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>
> ---
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
> 
> Trail of Bits has a reproducer for this bug that triggers a
> KASAN use-after-free and can share if needed.

Go ahead and share, syzbot has been reporting this race for some time, i.e. how
to repro this isn't exactly a secret, and the more testcases the better.  This is
also like the fourth or fifth proposed fix for the bug (bugs?).  I think the most
recent version of the fix we are pursuing is here:

https://lore.kernel.org/all/20260811094829.98794-12-dwmw2@xxxxxxxxxxxxx

Thanks!