From: Zeng Chi <zengchi@kylinos.cn>

kvm_set_internal_memslot() is supposed to reject memslot IDs that belong
to userspace, i.e. IDs below KVM_USER_MEM_SLOTS, but it compares the raw
"slot" field, which packs both the address space ID and the memslot ID
(as_id << 16 | id).  For any address space other than 0, the packed value
is always >= 65536, which is larger than KVM_USER_MEM_SLOTS, and so the
sanity check is a nop regardless of the actual memslot ID.

E.g. x86 sets internal memslots for every address space, including SMM,
so the check would silently accept a userspace memslot ID for the SMM
address space while rejecting the same ID for the normal address space.

Extract the memslot ID the same way kvm_vm_ioctl_set_memory_region() and
kvm_set_memory_region() do, so that the check covers all address spaces.
No in-tree caller trips the check; this only makes the sanity check
effective for all address spaces.

Fixes: 156bffdb2b49 ("KVM: Add a dedicated API for setting KVM-internal memslots")
Signed-off-by: Zeng Chi <zengchi@kylinos.cn>
---
 virt/kvm/kvm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 65eb26a0520d..e8d0e360ea26 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2128,7 +2128,7 @@ static int kvm_set_memory_region(struct kvm *kvm,
 int kvm_set_internal_memslot(struct kvm *kvm,
 			     const struct kvm_userspace_memory_region2 *mem)
 {
-	if (WARN_ON_ONCE(mem->slot < KVM_USER_MEM_SLOTS))
+	if (WARN_ON_ONCE((u16)mem->slot < KVM_USER_MEM_SLOTS))
 		return -EINVAL;
 
 	if (WARN_ON_ONCE(mem->flags))
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus

On Thu, 27 Aug 2026 19:22:00 +0800, Zeng Chi wrote:
> kvm_set_internal_memslot() is supposed to reject memslot IDs that belong
> to userspace, i.e. IDs below KVM_USER_MEM_SLOTS, but it compares the raw
> "slot" field, which packs both the address space ID and the memslot ID
> (as_id << 16 | id).  For any address space other than 0, the packed value
> is always >= 65536, which is larger than KVM_USER_MEM_SLOTS, and so the
> sanity check is a nop regardless of the actual memslot ID.
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/1] KVM: Mask off the address space ID in kvm_set_internal_memslot() check
      https://github.com/kvm-x86/linux/commit/7d2a727f44d8

--
https://github.com/kvm-x86/linux/tree/next