From nobody Sun Feb 8 02:22:43 2026 Received: from mail-pj1-f74.google.com (mail-pj1-f74.google.com [209.85.216.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03A3A327209 for ; Thu, 13 Nov 2025 23:22:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763076155; cv=none; b=Ec52zPpqj3cuiTTs0C2fVShiAHQb86xfqFqRgzzrobxMzXzOE96i3OooaXIeJcyCuKfon5QNmkV+2lizIkmNGRGwHK9x1LYUuPO0WE4NdlZywcjemYiwmjG04R7vPL/SbT8Vtygqnwpnb9mOoXmk8hUbsPAPx8CQ6Qi3Aky2lZY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763076155; c=relaxed/simple; bh=/VWlZDSuv9naY4NLxRhJm4wQD3LEcTOpEh4w9kEbqqA=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=jItySOyhrUKazx0HaMkYJ+MzRjFNQhk3rm3CF2NhGRVDOFB0sKJ+hxaS4QuKBxr+7cifH/ea3nEXD6e0h9n6mmC2xhO/cX2ImZaylQ1nhdtmf49UGv24Pxy2S7a7+nRtqeZRLzRlUh/gqaUR6uNViuulv7bVWGgXEzxqTcU50cQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=YV6YoEIM; arc=none smtp.client-ip=209.85.216.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="YV6YoEIM" Received: by mail-pj1-f74.google.com with SMTP id 98e67ed59e1d1-34378c914b4so2129353a91.1 for ; Thu, 13 Nov 2025 15:22:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1763076152; x=1763680952; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:reply-to:from:to:cc :subject:date:message-id:reply-to; bh=YqDQKKsD4NlY39DOQRuRFpStN8uevOuecrT0cTsshoA=; b=YV6YoEIMLiRoAG/KX/Wd0P0ThgCtsmTpruQb4OglV5BzuCSZv8n0DHNtWES+OJ5M3U IBxfF1bntrkzmU1cHA1lLKYyd6eOT9IgmavnB1Lvo+IjJEjhqM83WBz/p82kOIaZYbuf G6kR5/Gy9DKyx+98L4KjUrPNkmfHtM7Jjmzipe1pfQ0O1woQHvmmI2UMrtC2KSBZU19i NrIAsJL0MA3IfCudKndDLBxCn/p1k6PsAu/iY5s2lte8CAh/qdw2ulokPqxzcsTJD0GY yBbavNb1GFfoweNy2xGKR6FgypE6nkfyA+Ypot21BUpwvWiqRdEllQUGaUkMfWepZbZC BWDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763076152; x=1763680952; h=cc:to:from:subject:message-id:mime-version:date:reply-to :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=YqDQKKsD4NlY39DOQRuRFpStN8uevOuecrT0cTsshoA=; b=i+KVP8oVoWdpe+kd7LeB3uNW8RwdDTs24IqrVa2A6iXheEEcrMCAq56M4yC5cbOvfN hP7kGsw0s6cu3L93TLjB0nN99G2DZZrqXasHm3qhIjMX6/Ls9UAjfsXKNZf6eS9dWwaX cMmzSj7a+2ywRCQ9vwJMrcRq3HmqwOR/30qbRKNb6agglEU2qmvzVlk7Oz69Vfw6uLyR 1PjvpZy9XM4CK7K6id9hxZXLB9hp7BKgAXaVFUtLp3WY4K/mFd7aAdI+RZku88bhsIhz qI4gA2tD/AhKopwhh1mV8TohMKdb7Wqt4hvfvEbPesNJP8jCgbz+1xxc5SGMlMY5kU/M Grcg== X-Forwarded-Encrypted: i=1; AJvYcCXcs7eQn/PJjEYG9WKjVrXUB63dLj4sCcQzObGc6L7gGdSB8tPBt4oCzAbQ62jcyTnwci2s54tEdYAsL+g=@vger.kernel.org X-Gm-Message-State: AOJu0YzIa90T+5vXFTElwRaSH+fWquKZn6UKi1Lhyd5ZmCZXVAo9fgj3 St34Ohq8889/CYsjl4DGPvKUwUd3J1AN5agI6ajHV1Ni5bxAKc2pQVUFk6h9/6kfZgLXdxK1b51 DsNFCkw== X-Google-Smtp-Source: AGHT+IFjhnyoh8Yv2pXCQe5QRJjinRO2mbJ02VHtCtEcYlyDToK5jpB3wuTiT1o03A73h+aCsn94qEc9rKI= X-Received: from pjbha6.prod.google.com ([2002:a17:90a:f3c6:b0:33b:dccb:b328]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:e70d:b0:340:be4d:8980 with SMTP id 98e67ed59e1d1-343f9eb615cmr890278a91.14.1763076152304; Thu, 13 Nov 2025 15:22:32 -0800 (PST) Reply-To: Sean Christopherson Date: Thu, 13 Nov 2025 15:22:29 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.52.0.rc1.455.g30608eb744-goog Message-ID: <20251113232229.1698886-1-seanjc@google.com> Subject: [PATCH] KVM: guest_memfd: Elaborate on how release() vs. get_pfn() is safe against UAF From: Sean Christopherson To: Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yan Zhao , Vishal Annapurve , Sean Christopherson Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add more context and information to the comment in kvm_gmem_release() that explains why there's no synchronization on RCU _or_ kvm->srcu. Point (b) from commit 67b43038ce14 ("KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file") b) kvm->srcu ensures that kvm_gmem_unbind() and freeing of a memslot occur after the memslot is no longer visible to kvm_gmem_get_pfn(). is especially difficult to fully grok, particularly in light of commit ae431059e75d ("KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying"), which addressed a race between unbind() and release(). No functional change intended. Cc: Yan Zhao Cc: Vishal Annapurve Signed-off-by: Sean Christopherson --- virt/kvm/guest_memfd.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index fdaea3422c30..2e09d7ec0cfc 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -338,17 +338,25 @@ static int kvm_gmem_release(struct inode *inode, stru= ct file *file) * dereferencing the slot for existing bindings needs to be protected * against memslot updates, specifically so that unbind doesn't race * and free the memslot (kvm_gmem_get_file() will return NULL). - * - * Since .release is called only when the reference count is zero, - * after which file_ref_get() and get_file_active() fail, - * kvm_gmem_get_pfn() cannot be using the file concurrently. - * file_ref_put() provides a full barrier, and get_file_active() the - * matching acquire barrier. */ mutex_lock(&kvm->slots_lock); =20 filemap_invalidate_lock(inode->i_mapping); =20 + /* + * Note! synchronize_srcu() is _not_ needed after nullifying memslot + * bindings as slot->gmem.file cannot be set back to a non-null value + * without the memslot first being deleted. I.e. this relies on the + * synchronize_srcu_expedited() in kvm_swap_active_memslots() to ensure + * kvm_gmem_get_pfn() (which runs with kvm->srcu held for read) can't + * grab a reference to slot->gmem.file even if the struct file object + * is reallocated. + * + * file_ref_put() provides a full barrier, and __get_file_rcu() the + * matching acquire barrier, to ensure that kvm_gmem_get_file() (via + * __get_file_rcu()) sees refcount=3D=3D0 or fails the "file reloaded" + * check (file !=3D NULL due to nullifying the file pointer here). + */ xa_for_each(&f->bindings, index, slot) WRITE_ONCE(slot->gmem.file, NULL); =20 base-commit: 16ec4fb4ac95d878b879192d280db2baeec43272 --=20 2.52.0.rc1.455.g30608eb744-goog