The nx_huge_pages parameter is stored as an int (initialized to -1 to indicate auto mode), but get_nx_huge_pages() calls param_get_bool() which expects a bool pointer. This causes UBSAN to report "load of value 255 is not a valid value for type '_Bool'" when the parameter is read via sysfs during a narrow time window. The issue occurs during module load: the module parameter is registered and its sysfs file becomes readable before the kvm_mmu_x86_module_init() function runs: 1. Module load begins, static variable initialized to -1 2. mod_sysfs_setup() creates /sys/module/kvm/parameters/nx_huge_pages 3. (Parameter readable, value = -1) 4. do_init_module() runs kvm_x86_init() 5. kvm_mmu_x86_module_init() resolves -1 to bool If userspace (e.g., sos report) reads the parameter during step 3, param_get_bool() dereferences the int as a bool, triggering the UBSAN warning. Fix that by properly reading and converting the -1 value into an 'auto' string. Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation") Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman --- arch/x86/kvm/mmu/mmu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 02c450686b4a..3644d1db8be1 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -7488,9 +7488,14 @@ static void kvm_wake_nx_recovery_thread(struct kvm *kvm) static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp) { + int val = *(int *)kp->arg; + if (nx_hugepage_mitigation_hard_disabled) return sysfs_emit(buffer, "never\n"); + if (val == -1) + return sysfs_emit(buffer, "auto\n"); + return param_get_bool(buffer, kp); } -- 2.52.0