KVM: x86: Fix shadow paging use-after-free due to unexpected role

jira VULN-191426
cve CVE-2026-53359
commit-author Paolo Bonzini <pbonzini@redhat.com>
commit -
commit-source-sha 81ccda3
commit-source https://lore.kernel.org/all/20260626112634.1778506-1-pbonzini@redhat.com/
upstream-diff |
	This is a HAND-PORT, not a cherry-pick.  Upstream commit
	81ccda3 fixes kvm_mmu_get_child_sp() by adding
	spte_to_child_sp(*sptep)->role.word == role.word to its -EEXIST
	reuse guard, on top of the unexpected-GFN check.  That function does
	not exist on this 4.18-based tree (see the prerequisite "unexpected
	GFN" commit for the full rationale); the equivalent guard lives in
	the shared helper kvm_mmu_child_sp_matches() applied at the three
	fault-path reuse sites.  This commit adds the role.word comparison
	to that helper, using kvm_mmu_child_role() to derive the expected
	role exactly as kvm_mmu_get_page() does.  Functionally equivalent to
	upstream.

Commit 0cb2af2 ("KVM: x86: Fix shadow paging use-after-free due to
unexpected GFN") fixed a shadow paging mismatch between stored and
computed GFNs.  A similar hole remains if the modified PDE points to a
non-leaf page: the gfn can be made to match, but the role does not.  The
original large 2MB page creates a kvm_mmu_page with direct=1, while the
new 4KB mapping needs one with direct=0; because the reuse path did not
compare the role, the direct=1 page was reused.  Installing a leaf SPTE
then records an rmap entry under the walk's gfn, but when that child is
zapped its parent has direct=1 and kvm_mmu_page_get_gfn() computes the
gfn as sp->gfn + index instead of using sp->gfns[], so the recorded
entry is not removed.  When the memslot is dropped the shadow page is
freed but the rmap entry survives, and later walks dereference an sptep
in the freed page, causing the use-after-free.

Fixes: 2032a93 ("KVM: MMU: Don't allocate gfns page for direct mmu pages")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Shreeya Patel <spatel@ciq.com>

Author: shreeya-patel98

arch/x86/kvm/mmu/mmu.c

@@ -2110,29 +2110,32 @@ kvm_mmu_child_role(struct kvm_vcpu *vcpu, gva_t gaddr, unsigned int level,
 /*
  * Return true iff the present, non-large shadow-page table pointed to by
  * @sptep can be safely reused as the child for a fault expecting a page at
- * @gfn.
+ * @gfn with role derived from (@gaddr, @level, @direct, @access).
  *
- * Prior to the CVE-2026-46113 (unexpected GFN) fix, the fault-path walkers
- * (__direct_map() and FNAME(fetch)) reused a present interior SPTE without
- * re-validating that the child shadow page it references still maps the
- * walk's expected gfn.  A guest can arrange for the referenced child SP to
- * have a different gfn, causing rmap add/remove to compute divergent gfns
- * and corrupting the rmap list (pte_list_remove() BUG / use-after-free).
- * This matches upstream's kvm_mmu_get_child_sp() -EEXIST guard, which does
- * not exist on this (pre-6.2 MMU refactor) tree, so the equivalent check is
+ * Prior to the CVE-2026-46113 (unexpected GFN) and CVE-2026-53359
+ * (unexpected role) fixes, the fault-path walkers (__direct_map() and
+ * FNAME(fetch)) reused a present interior SPTE without re-validating that
+ * the child shadow page it references still matches the walk's expected
+ * gfn and role.  A guest can arrange for the referenced child SP to have a
+ * different gfn/role, causing rmap add/remove to compute divergent gfns and
+ * corrupting the rmap list (pte_list_remove() BUG / use-after-free).  This
+ * matches upstream's kvm_mmu_get_child_sp() -EEXIST guard, which does not
+ * exist on this (pre-6.2 MMU refactor) tree, so the equivalent check is
  * applied at each reuse site instead.
  */
 static bool kvm_mmu_child_sp_matches(struct kvm_vcpu *vcpu, u64 *sptep,
 				     gfn_t gfn, gva_t gaddr, unsigned int level,
 				     int direct, unsigned int access)
 {
+	union kvm_mmu_page_role role;
 	struct kvm_mmu_page *child;
 
 	child = to_shadow_page(*sptep & PT64_BASE_ADDR_MASK);
 	if (!child)
 		return false;
 
-	return child->gfn == gfn;
+	role = kvm_mmu_child_role(vcpu, gaddr, level, direct, access);
+	return child->gfn == gfn && child->role.word == role.word;
 }
 
 /*