From nobody Sat Sep 26 09:16:51 2026 Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4EFAD4746AB for ; Wed, 2 Sep 2026 18:20:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373226; cv=none; b=sYLkzq5WP/5VpvLLmc4eSJo7txS5yFDvA/j1SMwI43OJ2Fsh33UzgedcLDi+LHpPFrVjWRM27UobixJuDsz0tvGJssciun7/JMfKueV18iNjgJAMA/ZY6JryYQ5xdQIXnPYmCbyWxXeIgzREWgPlQv6fQow8vJ2QwATiDtyl7m8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373226; c=relaxed/simple; bh=4nM44dji28w11w5Jz6G8Fn8/bMsweabqa4o1j27fvSI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=rwpGrBeHQPS+611ptDsYy+l9XwAWvVcDRI57stmrR+9mnm65fwO9OVgejqQZIajBsdEdL5FHesvgXIVdX6wS1aodnbE6Z8fp9PwnV4nx7WCfZt2TF+yXR1qXOQzhBRFdn31qsfZTO3r/isCLxTxiHzvVRp+ImnCG7HB5R5RGduo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=hRLkLrhg; arc=none smtp.client-ip=209.85.210.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="hRLkLrhg" Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-85f3a39f3beso1441865b3a.0 for ; Wed, 02 Sep 2026 11:20:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788373223; x=1788978023; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ti7lJbGj6xN91aSen76gggEVAHK8aMIWKvWm2Rqm9Hw=; b=hRLkLrhglCKQLv3hOGl4+ipbDsqfaX/CEDWYiZ0EXyPdNSnxtfSJKs8tTyxBkhGver S4Hja+eTvNTr8Z/dQzj+g9nSQb0Jpw6Pi15pLtzpcaRtsnSJrUcPDvAuZVcCI8WZGPGJ AjTRDchhEn9JOj1jpvlWeaRSRyFJknkK7oSw75hARvVZ8sR4lEVfZLD51SpxPZxeZgXI nbPV1ZiQOXx7Sx05HsBc4yDOO/kGg+LQKTDLU5nqMkRJsYknAUqUCMSp0PkYMpY8IARl U8cyU7C4UA6RiBHU7AIovuWjaXNeERjewrdGe4ZKKzF+L+oDsMX5hapHIj+nKwQNEaeJ w5Tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788373223; x=1788978023; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Ti7lJbGj6xN91aSen76gggEVAHK8aMIWKvWm2Rqm9Hw=; b=qJFO12xKKGPIFQZZu6fs2hJH0SNhF94C2viSd9tGtCw4/5ClVNIVDwTvgT3Ug8hbTc 3AkkTiKjpLm7D0KWUY8NppPfBV/FBW6G0/TLgHribXcEaDSidisadbj7YklSWHOuEF1q VrDtKuivrzIr6ksg/fbCZ/dQ5zKba6BZ8FgnIT7fTvqJop4Fx6pYK7yHiWR0Am3TUi7m Y7lw/NnOxuG4mqE3NhrOt7V9SgaOhceXiOOFanbSQZorM1XpMTC/3UA/6pNkUSmmkMKw VnigMYz+LrvD6udwwtSv27e+7wa72YOdP/0X6uqHeezE7Bs0y8Z0CJGM8ly5q5riZ/pA hcmQ== X-Forwarded-Encrypted: i=1; AKwUvByb2nbpI1JiPDzQinu3ZzOkRoygXJ2QOqnl/brjDaLM7QbpOf7n1dbY9eQVSlfGUMQTVzZHSATOK9LJ0Ks=@vger.kernel.org X-Gm-Message-State: AFuF++md+Y1Tj5lCLy2IYo26x/PZIbHCSU9BSIpeUlxM4iA0W2l3HBCF PZqw72EfnGVYl99ouYCNrXgLoBfvf0HoDPb33+JONeXNE21x5WpFWpa0UyN+niS0X6JsKdQVS6P I98F4qg== X-Received: from pfwp50.prod.google.com ([2002:a05:6a00:26f2:b0:848:2e0e:62e]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:4298:b0:857:3b70:209 with SMTP id d2e1a72fcca58-85ed1d08cb0mr11287585b3a.1.1788373223333; Wed, 02 Sep 2026 11:20:23 -0700 (PDT) Reply-To: Sean Christopherson Date: Wed, 2 Sep 2026 11:20:17 -0700 In-Reply-To: <20260902182020.2615443-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260902182020.2615443-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.970.g62bdec98f9-goog Message-ID: <20260902182020.2615443-2-seanjc@google.com> Subject: [PATCH v2 1/4] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If inserting a memslot into a guest_memfd's bindings xarray fails, propagate the error back to the caller, i.e. fail memslot creation as well. Signalling success and continuing on with memslot creation results in use-after-free, as the guest_memfd instance will remain reachable via the memslot after the file is freed (kvm_gmem_release() won't nullify the file pointer due to lack of a valid binding). Opportunistically WARN and reject binding if KVM_MEMSLOT_GMEM_ONLY is already set, partly to guard against goofs elsewhere, but mostly so that KVM doesn't need to worry about clobbering flags when unwinding on failure. Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-spe= cific backing memory") Cc: stable@vger.kernel.org Reported-by: Stefan Teodorescu Reported-by: Dennis Tighe Reported-by: Sashiko Bot Closes: https://lore.kernel.org/all/20260823135031.4F6DC1F000E9%40smtp.kern= el.org Signed-off-by: Sean Christopherson --- virt/kvm/guest_memfd.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index b596486d184c..2c8d8735de5f 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -612,10 +612,14 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_= slot *slot, struct inode *inode; struct file *file; int r =3D -EINVAL; + void *xar; =20 BUILD_BUG_ON(sizeof(gpa_t) !=3D sizeof(offset)); BUILD_BUG_ON(sizeof(gfn_t) !=3D sizeof(slot->gmem.pgoff)); =20 + if (WARN_ON_ONCE(slot->flags & KVM_MEMSLOT_GMEM_ONLY)) + return -EINVAL; + file =3D fget(fd); if (!file) return -EBADF; @@ -654,7 +658,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_sl= ot *slot, if (kvm_gmem_supports_mmap(inode)) slot->flags |=3D KVM_MEMSLOT_GMEM_ONLY; =20 - xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL); + xar =3D xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL); filemap_invalidate_unlock(inode->i_mapping); =20 /* @@ -662,7 +666,13 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_s= lot *slot, * not the other way 'round. Active bindings are invalidated if the * file is closed before memslots are destroyed. */ - r =3D 0; + r =3D xa_is_err(xar) ? xa_err(xar) : 0; + if (r) { + xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL); + slot->gmem.file =3D NULL; + slot->gmem.pgoff =3D 0; + slot->flags &=3D ~KVM_MEMSLOT_GMEM_ONLY; + } err: fput(file); return r; --=20 2.55.0.970.g62bdec98f9-goog From nobody Sat Sep 26 09:16:51 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56E4349CF58 for ; Wed, 2 Sep 2026 18:20:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373227; cv=none; b=U+2MnpPeTaKB30H0THgd0FQ/12OdBBa4qCKrvP9t00AlxNmopnvf8Vv9MpE5crnNh2BiFsQuPJl/0CGRxDo1fOmhSUNCbeuO3gbEdcYqmha8dabrjLqOi43pPQb/KFWJSa9BknzYWurC5+Ptlx34hJNe3qvYPvFUqhefWhY44fA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373227; c=relaxed/simple; bh=SNf4WUEJ+xEg0G0RzQZ95uMwbsxag8eFYUy+XvGm2s8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=jKNLCs0QWKTQz+533YzifW5gHo3OEvPA6VUi5TuW5TR/TKleGDYxa0mtU7jCpiLoP+gzu3dpTkEiob02QcsczIyMeqSu0B+ZUuF5xM+Iz01obTpPKxM8HpweiM+L+s+xfD511tLS0HlxMPsBwSa/Ribv2PAEA8wqcIGJl0qAWxo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=dD89G+Ww; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="dD89G+Ww" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-38f283baf1fso1986204a91.3 for ; Wed, 02 Sep 2026 11:20:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788373225; x=1788978025; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=enQThv/Z+5wbYGLAU8qGaGyyNyk23OKTo0dZTiQBGes=; b=dD89G+WwCZoQ+6md2/KGc+sbBlpN0baCzastzoNpeaxcVECx+r0+H85a/AhSlAESpB 2p37Rc/wAjKpSLxmZmUbsWwU7Q/fmhtcmfBmWeOkZstD9GgdbUmNIeIloO7exxh7FAmp i0mIKIb7LZUgNx56Q8DCXbWAGgpDlOQnPKjhQyrNvLt2wwqs05r/cuQjEzmWhmxFpazX v+WxBQPKyYoKZT9cm5UJVHPP0cpcWSylGfWFkGyvZt5vYDBzyK/sHP2311Pr5pt/L/nI 3OO1enVlQ6+voNihDWQ/8uSstuFvgsDMv7HNYYrOwd0yB4ZBMLl3V5v6u5YKbLgwQ9ye en8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788373225; x=1788978025; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=enQThv/Z+5wbYGLAU8qGaGyyNyk23OKTo0dZTiQBGes=; b=OXkYLj0IbdMhlU6cTCgpH12pJ5Q00c09TXSTLa//xUzTMw+tSwi0KdUdVVdyy0JhZD nRqYgp0tLEzzRtWiFP4+7hoCC4lE+CMXIH0SOYUAXIrVL8VXGyCPXw4HMR3gtNlLTaKl B4PT/c8Km9KdSYHNBolLOsz4QgyM0fKyWWsY5LSSW9HSGBC61w3eBJMUdH3NCk/effZG uKn9l4wki3kfZZ/OKQBKO+GaG2M1WeWeU5K3ANXx5rnpe1CcygO6FpbdEuSZcoCT5SVb XaGM6n03BdteSbRr0POEa68ajmv7t5Z78BvxlSrenwCalRX+pjfS/hQ/aJT/LrK6UNJu WIDg== X-Forwarded-Encrypted: i=1; AKwUvBxeJNeEChBptihWFFZVPvDZJ/OlTVH9K3L5IpujwsXNp992BCmPrzcouxaOsSDGHqKtz7B6rgNGwcbLmdg=@vger.kernel.org X-Gm-Message-State: AFuF++k4Rums1UQ5M9qDneHa9kUhsOHavrPsF2lXsNgp4kjIpDrOzEJG nKT1tHktFuQA3rwUAT/ee+iA2iCGHllM0viFeVIq8tsP2T+AT4//+7c3O30Z+1kezDdosbpLJ5V Fz/xlQQ== X-Received: from pjblp16.prod.google.com ([2002:a17:90b:4a90:b0:396:67ed:da2f]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:17cf:b0:398:d286:344d with SMTP id 98e67ed59e1d1-39aee178e92mr9991369a91.22.1788373224396; Wed, 02 Sep 2026 11:20:24 -0700 (PDT) Reply-To: Sean Christopherson Date: Wed, 2 Sep 2026 11:20:18 -0700 In-Reply-To: <20260902182020.2615443-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260902182020.2615443-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.970.g62bdec98f9-goog Message-ID: <20260902182020.2615443-3-seanjc@google.com> Subject: [PATCH v2 2/4] KVM: Use goto to handle errors during memslot preparation From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Use a goto to unwind early memslot changes if preparing for a memslot operation fails. This will allow moving the creation of guest_memfd bindings into kvm_set_memslot() without needing to copy+paste the unwind logic. No functional change intended. Signed-off-by: Sean Christopherson --- virt/kvm/kvm_main.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 65eb26a0520d..3c0dbe60a5b4 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1931,21 +1931,8 @@ static int kvm_set_memslot(struct kvm *kvm, } =20 r =3D kvm_prepare_memory_region(kvm, old, new, change); - if (r) { - /* - * For DELETE/MOVE, revert the above INVALID change. No - * modifications required since the original slot was preserved - * in the inactive slots. Changing the active memslots also - * release slots_arch_lock. - */ - if (change =3D=3D KVM_MR_DELETE || change =3D=3D KVM_MR_MOVE) { - kvm_activate_memslot(kvm, invalid_slot, old); - kfree(invalid_slot); - } else { - mutex_unlock(&kvm->slots_arch_lock); - } - return r; - } + if (r) + goto err; =20 /* * For DELETE and MOVE, the working slot is now active as the INVALID @@ -1977,6 +1964,20 @@ static int kvm_set_memslot(struct kvm *kvm, kvm_commit_memory_region(kvm, old, new, change); =20 return 0; + +err: + /* + * For DELETE/MOVE, revert the above INVALID change. No modifications + * required since the original slot was preserved in the inactive slots. + * Changing the active memslots also release slots_arch_lock. + */ + if (change =3D=3D KVM_MR_DELETE || change =3D=3D KVM_MR_MOVE) { + kvm_activate_memslot(kvm, invalid_slot, old); + kfree(invalid_slot); + } else { + mutex_unlock(&kvm->slots_arch_lock); + } + return r; } =20 static bool kvm_check_memslot_overlap(struct kvm_memslots *slots, int id, --=20 2.55.0.970.g62bdec98f9-goog From nobody Sat Sep 26 09:16:51 2026 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFEB44A4832 for ; Wed, 2 Sep 2026 18:20:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373228; cv=none; b=OsLruHosZeuZ6Ld/u+BcttG7f+C/VEzYZi3kbnyhMiKJisu7U3MPY45wTcyzVLaXJRQn4aVROzWxEhQ3jLOtB4ntoIPX4upxJxnh3Amj4egW3KzV8ja2jrLB384NpeZcSydvpT1WdFPgNTDIob7HDjlSISL2A47D2Q3hZIovTqw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373228; c=relaxed/simple; bh=djMXOvbx8+jE/Zv26hYHX8VjpJu2WZt5sjmIhcDZ4Bk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=q+KjcFIRtuEi1lNOa327CcbeSKjDvpbDjyny/9Muj826nQ9O5CybLzkSDDLM4+9ZypaoVusCqszJLB48dMjl6ZzhQmLf8afCf7C1LcafZegfTTLJxHPOepcT4Eg8KXbCENZpRLSsmQcLghu9iVolNCzrYZSx79A7PUvn70zcaj4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=HaX1pMxi; arc=none smtp.client-ip=209.85.210.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="HaX1pMxi" Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-85602449126so3094537b3a.0 for ; Wed, 02 Sep 2026 11:20:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788373226; x=1788978026; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=i8M/XWb6OKKdr40v6XtMfNASOvXcHPC8vp7zr28IIVA=; b=HaX1pMxigI9wTuRowcmYdOrhmI7g+PSN7N8MX8WqHs+G4NCj5QU2qvP3wvHzrGshcM FSykprSxSzdWQ5BpxvetTOiVfkKK8IYpPMGwXXgRIl/HzK0MzPeCSgHB6yIi8IWfY0dN r4Y0DtAFPMIdEVpvRtm1UphHwNFEanHMs++DOWR8JJyW59S3UP9Li4hEDwEgK7OqMEll /1s/6dq9utW2ZHOlCgIk2nMI9HCq65ZqEpcnlClipDVD/bNpoRk6gM20EirxRk6QQAbl 6DhWGWUWY/YhfcfA9xoWQLmw9Qw9trnzN906kra4w6hFd96XmBmCZW1wb8RL47cyPR8N eHWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788373226; x=1788978026; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=i8M/XWb6OKKdr40v6XtMfNASOvXcHPC8vp7zr28IIVA=; b=MfJQbubrTtQXdGRjygu6z7/VAD86UT37Zul9hRueHbaBI6xRQYYneJKYFbFc8YZyoV KfjOHO14PJ5OL8CNotv0kMZcdw4i059oJPx0j1YqvCFHJWd9/V0Y7idj+h5n14p3PVoc 9vgFKaSTA0ke+CMDO0fshzZQSQL5/wDn3pgUaos7OzzR6STK8KA64snGYE02y9fVWA32 JvYGCTEIJADCOVdDhA/6r0NsuoXFP1BU4UeAMuuaqJ1jJwlSaIxgklZEeNDSI8VbT6do 9Hwmz+tKqYcPZxI0aeC+xqeXQJ4aZujCNZyR+sPnI/7deRoYGtWhU9O6qXNVY7VHfmuO pd0Q== X-Forwarded-Encrypted: i=1; AKwUvBxIyKmr9KWwD01tprVHrCnyxlVwsXqpzdseHQMjrVxpkjaMoK723y9HAmPQuDxYj3RaekFaXyVBvm2SNNc=@vger.kernel.org X-Gm-Message-State: AFuF++kUbu0QxCjdobDNrIkOJcn8Qd3i7CPSj4jIaMS+h8EN56te0ATm oKsRj0OqJqDs/5k89lfSrg/Pb1zDMnqPTcBlY5F3+Jk3LlsgrMB4C8blBl/BxZ+3IjTkAVSXehx Vs5h/6A== X-Received: from pfbkq17.prod.google.com ([2002:a05:6a00:4b11:b0:847:9be8:84d5]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:4f81:b0:857:726d:270d with SMTP id d2e1a72fcca58-85ed4c1b14amr10098967b3a.25.1788373225757; Wed, 02 Sep 2026 11:20:25 -0700 (PDT) Reply-To: Sean Christopherson Date: Wed, 2 Sep 2026 11:20:19 -0700 In-Reply-To: <20260902182020.2615443-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260902182020.2615443-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.970.g62bdec98f9-goog Message-ID: <20260902182020.2615443-4-seanjc@google.com> Subject: [PATCH v2 3/4] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Wait to bind a memslot to a guest_memfd instance until *after* the memslot is fully prepared, as creating the binding in guest_memfd will effectively expose the memslot to readers. As pointed out by Sashiko, binding the memslot before it's ready to be exposed to the rest of the world can break various memslot assumption and rules. E.g. x86 could observe a NULL rmap pointer if a PUNCH_HOLE hit the guest_memfd after the binding was created, but before KVM made it through kvm_prepare_memory_region(). Begrudgingly resort to passing in the guest_memfd fd+offset pair to kvm_set_memslot(), as creating the binding really does need to happen in the middle of setting the new memslot. Alternatively, to preserve the aesthetically pleasing function prototype, "struct kvm_memory_slot" could be expanded to track the fd and the file, but that would create the possibility for TOCTOU bugs on the fd vs. file, and would add zero value beyond making kvm_set_memslot() look pretty. Fixes:a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-spec= ific backing memory") Cc: stable@vger.kernel.org Reported-by: Sashiko Bot Closes: https://lore.kernel.org/all/20260826170551.BEF801F000E9@smtp.kernel= .org Signed-off-by: Sean Christopherson --- virt/kvm/kvm_main.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 3c0dbe60a5b4..21c10cbbac66 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1887,7 +1887,8 @@ static void kvm_update_flags_memslot(struct kvm *kvm, static int kvm_set_memslot(struct kvm *kvm, struct kvm_memory_slot *old, struct kvm_memory_slot *new, - enum kvm_mr_change change) + enum kvm_mr_change change, + unsigned int gmem_fd, uoff_t gmem_offset) { struct kvm_memory_slot *invalid_slot; int r; @@ -1934,6 +1935,15 @@ static int kvm_set_memslot(struct kvm *kvm, if (r) goto err; =20 + if (new && new->flags & KVM_MEM_GUEST_MEMFD) { + if (WARN_ON_ONCE(change !=3D KVM_MR_CREATE)) + goto err_bind; + + r =3D kvm_gmem_bind(kvm, new, gmem_fd, gmem_offset); + if (r) + goto err_bind; + } + /* * For DELETE and MOVE, the working slot is now active as the INVALID * version of the old slot. MOVE is particularly special as it reuses @@ -1965,6 +1975,13 @@ static int kvm_set_memslot(struct kvm *kvm, =20 return 0; =20 +err_bind: + if (new) { + kvm_arch_free_memslot(kvm, new); + + if (new->dirty_bitmap && (!old || !old->dirty_bitmap)) + kvm_destroy_dirty_bitmap(new); + } err: /* * For DELETE/MOVE, revert the above INVALID change. No modifications @@ -2059,7 +2076,7 @@ static int kvm_set_memory_region(struct kvm *kvm, if (WARN_ON_ONCE(kvm->nr_memslot_pages < old->npages)) return -EIO; =20 - return kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE); + return kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE, -1, 0); } =20 base_gfn =3D (mem->guest_phys_addr >> PAGE_SHIFT); @@ -2106,21 +2123,14 @@ static int kvm_set_memory_region(struct kvm *kvm, new->npages =3D npages; new->flags =3D mem->flags; new->userspace_addr =3D mem->userspace_addr; - if (mem->flags & KVM_MEM_GUEST_MEMFD) { - r =3D kvm_gmem_bind(kvm, new, mem->guest_memfd, mem->guest_memfd_offset); - if (r) - goto out; - } =20 - r =3D kvm_set_memslot(kvm, old, new, change); + r =3D kvm_set_memslot(kvm, old, new, change, + mem->guest_memfd, mem->guest_memfd_offset); if (r) - goto out_unbind; + goto out; =20 return 0; =20 -out_unbind: - if (mem->flags & KVM_MEM_GUEST_MEMFD) - kvm_gmem_unbind(new); out: kfree(new); return r; --=20 2.55.0.970.g62bdec98f9-goog From nobody Sat Sep 26 09:16:51 2026 Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F38B1478E3E for ; Wed, 2 Sep 2026 18:20:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373230; cv=none; b=aYdyw6/3+Rj9iHrrzSNhMTS4kj0O/TlDNpZobmRPPdc1i+k0mdDiGttaLZxARyS0kpUFPrHfHWNR8hizNTk2SRJnwLV7w1bNn1JFHFpjTF/3g9LXzposQtpMwju3LPt0gZPlu324YHz1vCI0ZkLz0hSP8Sd8uFJuKZ8B+oV31b8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788373230; c=relaxed/simple; bh=R/K5UWhNFqj3ZcM4cwx3BkSTRdQNwDAHdg7ioV3umQ0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fVzEY07ZeuAaaiij10is1wQ3IFWsxORhNd3yh7lGalp/WfuSOMQBVuTdzs7roLszESeOUyasRI1mXzaaa3sg0EevGdjhagOhITLvrDnxJse759eRUM0P4gKCeHmsf+7x2DzyDOxgaB3Dne/t5OmMhW1lpe+IPplgJyV7xCG83C0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=PYeP9zHg; arc=none smtp.client-ip=209.85.210.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="PYeP9zHg" Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-8535db07af9so722547b3a.2 for ; Wed, 02 Sep 2026 11:20:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788373227; x=1788978027; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ER0xLmEoKu3WiTJI8f5zgte0kZ2FP3/FFPxtMYpTVLw=; b=PYeP9zHgSsv3a8T64C2MCHn4cgmAEXPMMuCjxTxwRMY16GG355/xmzjZC+0LRkPQqf lq5ed/mQAUvKCSladaFzm1vkvHkarhcqIgXycYR3s7FikiwCbzrZPoyBaauuAc7W3wKc KNF4ByVrakx35n9uPIAm/+MHvUwG0QDPajl8uV55vKOm8zZoQxyXWCm2t/39CTYj54BV LuuAPRViZf3tz2dcBELGhBOjHcMw23OIR21gf3v6f24DT7g42SCAio61HMlTtc1bs8YB +b9SxDzgN4Pdhm9zY6sUUCRuZ3+YgaJbS6dYRMzz0hin8eY+j37pQLPOz2Nm68n82RtW 060g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788373227; x=1788978027; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ER0xLmEoKu3WiTJI8f5zgte0kZ2FP3/FFPxtMYpTVLw=; b=S3yJ8okr02P6HwZAaqTa7+Oj6XuqToNS0gdwUA25O0RBlZNZKIcMZeAJzUkvARK3tC AAT38c9HLhQ7k6zkZcBWR5RR908oNHuCJtL3Of+m0kAHMVcCUiMFK3Bv7ieJDNZTJGVO MY+i9IlSIYGn/qzYF167TZe5++UplT4TT/gBwq1O43BKWvzNEI1PpBnXIFHv/VXhyFYT CKqfb3GIobegffpR+fwZzU8yJWbbta7g1l/X0PPC6dz2qxiobk8q9l2ZPSpcM89Nupar HjQhK+8hK/MccLXH0gwuudTfE3ElcWuRDz3kr/+2DUQ8HowSdK9p+q+6+0KvA6DcfyoA zNwQ== X-Forwarded-Encrypted: i=1; AKwUvBzmgO2YA/trrjONCN6d1uF93fILcnLhR6fzqHFOTHpza53pDNgO0QFpyr6jgJI4LhTDGfJE3BZDnJMK8+I=@vger.kernel.org X-Gm-Message-State: AFuF++k0lR6eUwhpOfrIoCxnlVFNhHyfqVq5rSPlowBh5W+JJG0UdxDA Ypy29s/te54zi9EkDfXYFEzSKW6l2HL0PwNPTI54lvMv7bJTFYFsV7zc7i6qYcKKGaMB1mCBmHt mbzHWkg== X-Received: from pfbfb9.prod.google.com ([2002:a05:6a00:2d89:b0:85f:34bc:42ef]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:9295:b0:837:e9cc:d474 with SMTP id d2e1a72fcca58-85ed1d07a02mr9437959b3a.2.1788373226909; Wed, 02 Sep 2026 11:20:26 -0700 (PDT) Reply-To: Sean Christopherson Date: Wed, 2 Sep 2026 11:20:20 -0700 In-Reply-To: <20260902182020.2615443-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260902182020.2615443-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.970.g62bdec98f9-goog Message-ID: <20260902182020.2615443-5-seanjc@google.com> Subject: [PATCH v2 4/4] KVM: guest_memfd: Drop superfluous WRITE_ONCE() when binding a memslot From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Drop the superfluous WRITE_ONCE() when setting a memslot's guest_memfd file during initial binding, as the memslot *must* be inactive and unreachable. The superfluous WRITE_ONCE() was added by commit 67b43038ce14 ("KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file") to maintain rough "parity" with the existing rcu_assign_pointer(), not realizing that the only reason rcu_assign_pointer() was used was to make sparse and other checkers happy. Cc: Yan Zhao Signed-off-by: Sean Christopherson --- virt/kvm/guest_memfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index 2c8d8735de5f..323159c9b5f3 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -653,7 +653,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_sl= ot *slot, * kvm_gmem_bind() must occur on a new memslot. Because the memslot * is not visible yet, kvm_gmem_get_pfn() is guaranteed to see the file. */ - WRITE_ONCE(slot->gmem.file, file); + slot->gmem.file =3D file; slot->gmem.pgoff =3D start; if (kvm_gmem_supports_mmap(inode)) slot->flags |=3D KVM_MEMSLOT_GMEM_ONLY; --=20 2.55.0.970.g62bdec98f9-goog