From nobody Thu Sep 24 18:41:54 2026 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE96C50278A for ; Mon, 21 Sep 2026 21:06:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024784; cv=none; b=g6xxtn1Bwq8s1PJfNOChr9zqkLj9wy5pTsNwT+IeQOjmLITp1sZCbkMf+IHVRGoeFdiBtKPvExgumKRfi5u7KCdlPEAGS/6jHT26jzZ2QrXbCblXjAneJkYnr2kywif5OVFDggmhQ7ylMiBfSHg6immfWc8w8fwJUvpImHx+rGw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024784; c=relaxed/simple; bh=+OgMs5FTH885W5hqbW9mZemd9t74Q3YKNRON5By5iS4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=t6CnX9SJIFfNmRGc2kxH+BtRbRm7s5IDz44LOF1VAOu/+2gG+nkZquHnRSLEdnuJa03SFaTEqSTeLCJJlayJbHSHbu3EDdblnI1hAkJuhw+fisxyDhbqyD7PRt+iMx8dA2tjoHWNcdoBQZzpkbWfU2GaobxQng3MMDC8S0lT9yg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=n4OA6sjE; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="n4OA6sjE" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2d7443e0f0bso63878915ad.1 for ; Mon, 21 Sep 2026 14:06:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790024782; x=1790629582; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TG/mu75XYT0SNXMXtTJlKEYyCMKeyuwB8Y7qCUcxVbg=; b=n4OA6sjEZF92BAlbp9JU2aCPRd4P9PDwQMeHV01g7L0eFn0MCo7YpRfMgRtslmhoxU Ul4bjRW/BUlrEijbHnc7/XAFNUy83bv1zMemZ5PV0m8q1NYbWvAqSntntJC+qun9y5G7 9gDfZpi+c3ImGUjcB8wbmXMIvqkgb1OrItXukDiybgepHCybZZNvi4L2SQLmE/97FWE6 zeS0AZ8QukRIz9CqHikAraNkPu3H3K8KnEDQiQxQKCm+/xdD1rVXBw7U1lbFjNB0M67u dpdSLQDyy4clOKG5qtPAMpu+wPWWkyEKWin5aF8DRg0wDyikps2UHpKw6Wlnlydy7KIv VR0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790024782; x=1790629582; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=TG/mu75XYT0SNXMXtTJlKEYyCMKeyuwB8Y7qCUcxVbg=; b=0muEtDZKi+gaXuyRvDutMXJlDmHado0RO5fT7srW7oQI8Dn2Xv1WtXlY415deHQmck a5y9GnvojX8YtiMiQ8HO7WNpx5wKD0Y8W/Nw8V1xwAuh1ctIWyoUq8HMOWCNZ6P5HJa0 aog5d2yHlBWoDVfJymISC3FnTGujGwcekGAktOs5YTEg02vUK1sQbk9toRp1HvrVbVzS svtwhKzHTAdG4XC+mnJ7/Zf23rgAik4hY/D4yxfFN+s7FpDFbd1+lP+G+LQeNhiEQtwY WGRrj3i7TdvC6LRWG+P02CPBNHBIrsYqAIV6+eyOGVToB5iQfeBUNQc1X2Yffj46lMfw p7yQ== X-Forwarded-Encrypted: i=1; AKwUvBzCsoFVtlXVUrOdyD9dBvrmgxv2QTgVLvxIas72tlFb55O8KCNQ4vOzAnL8ej6533sGwamO2WWCkjqEq60=@vger.kernel.org X-Gm-Message-State: AFuF++mftu875fKKfSrxufQOQWAg2BBP8fRpQo+Ts/MTqQemQeeYJqa2 ydzD97RvGZpJb+ePMQxFrOOjhGGKWiI0a3MathBpS7bxN3ebdPUH0aoluctRVd83zC3MlZ+Y+h1 8bxKACA== X-Received: from ploc3.prod.google.com ([2002:a17:902:8483:b0:2dd:fc2:99fe]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:4b28:b0:2dd:c100:a5e7 with SMTP id d9443c01a7336-2ddc100a6e5mr106367345ad.59.1790024780575; Mon, 21 Sep 2026 14:06:20 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 21 Sep 2026 14:06:12 -0700 In-Reply-To: <20260921210616.1024168-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260921210616.1024168-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260921210616.1024168-2-seanjc@google.com> Subject: [PATCH v4 1/5] KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot From: Sean Christopherson To: Paolo Bonzini , Sean Christopherson Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Ackerley Tng , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If inserting a memslot into a guest_memfd's bindings xarray fails, propagate the error back to the caller, i.e. fail memslot creation as well. Signalling success and continuing on with memslot creation results in use-after-free, as the guest_memfd instance will remain reachable via the memslot after the file is freed (kvm_gmem_release() won't nullify the file pointer due to lack of a valid binding). Opportunistically WARN and reject binding if KVM_MEMSLOT_GMEM_ONLY is already set, partly to guard against goofs elsewhere, but mostly so that KVM doesn't need to worry about clobbering flags when unwinding on failure. Regarding the unwind, the slot must be fully prepared before inserting it into the bindings, at which point the slot becomes reachable. I.e. waiting to update the slot in order to avoid the ugly unwind isn't an option. And as part of the unwind, explicitly nullify the relevant bindings, as xarray can store a subset of entries when populating a range. Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-spe= cific backing memory") Cc: stable@vger.kernel.org Reported-by: Stefan Teodorescu Reported-by: Dennis Tighe Reported-by: Sashiko Bot Closes: https://lore.kernel.org/all/20260823135031.4F6DC1F000E9%40smtp.kern= el.org Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ackerley Tng Signed-off-by: Sean Christopherson --- virt/kvm/guest_memfd.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index 63943aa253d4..c094611f7c7a 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -654,6 +654,9 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_sl= ot *slot, BUILD_BUG_ON(sizeof(gpa_t) !=3D sizeof(offset)); BUILD_BUG_ON(sizeof(gfn_t) !=3D sizeof(slot->gmem.pgoff)); =20 + if (WARN_ON_ONCE(slot->flags & KVM_MEMSLOT_GMEM_ONLY)) + return -EINVAL; + file =3D fget(fd); if (!file) return -EBADF; @@ -692,7 +695,13 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_s= lot *slot, if (kvm_gmem_supports_mmap(inode)) slot->flags |=3D KVM_MEMSLOT_GMEM_ONLY; =20 - xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL); + r =3D xa_err(xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNE= L)); + if (r) { + xa_store_range(&f->bindings, start, end - 1, NULL, GFP_KERNEL); + slot->gmem.file =3D NULL; + slot->gmem.pgoff =3D 0; + slot->flags &=3D ~KVM_MEMSLOT_GMEM_ONLY; + } filemap_invalidate_unlock(inode->i_mapping); =20 /* @@ -700,7 +709,6 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_sl= ot *slot, * not the other way 'round. Active bindings are invalidated if the * file is closed before memslots are destroyed. */ - r =3D 0; err: fput(file); return r; --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 18:41:54 2026 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1DB34E325F for ; Mon, 21 Sep 2026 21:06:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024785; cv=none; b=t73pdKc6fQqZJSjE3aiQYRMEXBWdgy/o3TBuwT+dR77gy7NHg9rZAK/+aQAEcFmT+H4zO25zr1h/yx8sqZIaECZ6vvFxIjwQXdG43oaCa/i1Z06bLX4xZVdcLU5WKe9aj+CFrwAKzJyXagLMxe4ZuYqaZGIaCk2ePPdduETPP88= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024785; c=relaxed/simple; bh=JdOJf+2+GAEhZwBCGYJCZV2CMdKHgYqKlljHYuL2tJQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=O+ELw32jTMlg0h4OCSCY7JOLHcGotfHhcmr4AcjUDH22h0fOO1sfx0WUJxQ2u7C11Ls/id3EfVkO+ikmOfHFQdDD9cY1tIG/gDRvkFLffDXUFBVh2ES7CNCfYpz+Y5t5P3TQVLnUP2tCEazomZot5dM/WncfdFsmmCuv5yIZauI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=IkuDeVVU; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="IkuDeVVU" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-39e3c10ac70so8574703a91.2 for ; Mon, 21 Sep 2026 14:06:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790024783; x=1790629583; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=jDeElCc4OjANkEErvoKCXV2KgfEdeXF0F1dMXf8gxcA=; b=IkuDeVVUUR/q+W05XYLEFzEqySGHU5H0VmQSGl4AOsF9rAJ5gKiP4VGngpdV117eXu iBVPuB+bWtGY3DAmas5HIJ+RZvvFdveaDpRRqlZ0XOwDHq7gAUZkdkoNJ8Bk4BbXEBk3 jgsSqW4TgZNubpk/hSkYrW4vSzU9oCyD65GkoFnBj1i8jSje77DLc4YUucVKTpR0TK1G wC9j0ZptdFNalEKnzNJhS4LAv14xBJs85nBEPCu8ZpfRJMjJT5xv8dgW0fCR1izU4Sgh o1bsynFf/x7BuasuUC7qYJMXul/Un54Tost1kCovadJhfT5t+/NnM37XS8TyDURQB6tX pbBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790024783; x=1790629583; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=jDeElCc4OjANkEErvoKCXV2KgfEdeXF0F1dMXf8gxcA=; b=mTabotTwTvyYIE3Zi9mCHwq/GTVuGrj7aEkRXCWWh9ZgQTknoZg9eqROEnqSSl6vQG gYkhE8awpdPTimEqzhYAW2gnN0xL0Nqq/+f7QaY2bOa/qibBnlsF3zYuzBVCz1LUZWmr bUVpepZteAkbJJOypDW7lWHoVpTzMqgfOoO0ne37s2LsrCI3DsE7yVcMfocoQolZrfNg TvUWXr5Sxyyf022kWs96fp/N7i8OQZR2uXf5AhcbrZ7fCrAgWa/27/w27S5RmmeAcBma +kb55NaCSjt9MJgsfihZbiksuulaSMRu/DG+JHqiLkcDxeTLXe/nu/P8M1pgxTlwCL76 eWwg== X-Forwarded-Encrypted: i=1; AKwUvBySOQpAUg2ocfltijHQYi0LKmjD7DUViHxFsKg29pO2+TtE4zfJKP5l0INNgJw4KLdEmOlTc6Y2CjfbV2Y=@vger.kernel.org X-Gm-Message-State: AFuF++m2PxaP9mbF9+Bg1gWJGChruNyKcULIvXO5694jFQK6l3R25xx7 /Gbq8HYHW4NIPMv1KbrMHeZI7usWezZe6Ik+v9Yi35r5POTkek9KlTdMKGJIPgddG8FuhqiiyrL t0iHunA== X-Received: from pjbhh5.prod.google.com ([2002:a17:90b:4185:b0:39e:2690:b1a6]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:51:b0:3a0:2c7d:eddb with SMTP id 98e67ed59e1d1-3a02c7e2fcdmr8300758a91.32.1790024783047; Mon, 21 Sep 2026 14:06:23 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 21 Sep 2026 14:06:13 -0700 In-Reply-To: <20260921210616.1024168-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260921210616.1024168-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260921210616.1024168-3-seanjc@google.com> Subject: [PATCH v4 2/5] KVM: Use goto to handle errors during memslot preparation From: Sean Christopherson To: Paolo Bonzini , Sean Christopherson Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Ackerley Tng , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Use a goto to unwind early memslot changes if preparing for a memslot operation fails. This will allow moving the creation of guest_memfd bindings into kvm_set_memslot() without needing to copy+paste the unwind logic. No functional change intended. Cc: stable@vger.kernel.org Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ackerley Tng Signed-off-by: Sean Christopherson --- virt/kvm/kvm_main.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index d9da8b51614a..24cf96840827 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1941,21 +1941,8 @@ static int kvm_set_memslot(struct kvm *kvm, } =20 r =3D kvm_prepare_memory_region(kvm, old, new, change); - if (r) { - /* - * For DELETE/MOVE, revert the above INVALID change. No - * modifications required since the original slot was preserved - * in the inactive slots. Changing the active memslots also - * release slots_arch_lock. - */ - if (change =3D=3D KVM_MR_DELETE || change =3D=3D KVM_MR_MOVE) { - kvm_activate_memslot(kvm, invalid_slot, old); - kfree(invalid_slot); - } else { - mutex_unlock(&kvm->slots_arch_lock); - } - return r; - } + if (r) + goto err; =20 /* * For DELETE and MOVE, the working slot is now active as the INVALID @@ -1987,6 +1974,20 @@ static int kvm_set_memslot(struct kvm *kvm, kvm_commit_memory_region(kvm, old, new, change); =20 return 0; + +err: + /* + * For DELETE/MOVE, revert the above INVALID change. No modifications + * required since the original slot was preserved in the inactive slots. + * Changing the active memslots also release slots_arch_lock. + */ + if (change =3D=3D KVM_MR_DELETE || change =3D=3D KVM_MR_MOVE) { + kvm_activate_memslot(kvm, invalid_slot, old); + kfree(invalid_slot); + } else { + mutex_unlock(&kvm->slots_arch_lock); + } + return r; } =20 static bool kvm_check_memslot_overlap(struct kvm_memslots *slots, int id, --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 18:41:54 2026 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB1DB51474F for ; Mon, 21 Sep 2026 21:06:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024787; cv=none; b=cO1zwaCJmz2tmZRM7ky5h2J4icG7LvcMS0AbU07KffeZu3q6J4wBWcdzdcWKGpNJeh6nZUCDQ3PT2ez8V7OU3lvhuBBuqlld0vAVXrn3qWUwGxhN/B9EPCpJFGYGGQfgfZACIG11gyDAB/5DK08e//Q8CAbu5mRgcjauuFsCdjM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024787; c=relaxed/simple; bh=a/Ta7ugmnfE2olxYhVTUQxbez2+HQ62mFKA5+uOWAR8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=tKYZUiU9yduKuslefXU7MNT0tuWKpadf8clYTdUAyHK29gRvo026z+p3j2RL1Jzv/lk7dUGMFPF3BsgfhigsCxWeGWtVAe8RWx8B5sXKAcduc5ny49Yfkkd/CONkQ0zyu0//BwyBZiS0Epp8bgKsL/OfGVjmkEu4k7v9p3lBf4Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=OaViMNEa; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="OaViMNEa" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2d94f086fedso49973275ad.1 for ; Mon, 21 Sep 2026 14:06:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790024785; x=1790629585; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=e5qHde0DG0iGDJnHfYl3SHserU3q1V+JrrCFiXRle6c=; b=OaViMNEaC5skwUOwyqd3bDKWSZ+QRJ38McApbcbvck912eWXdoBGysYXzxUs3aHJtm A21BF4tlL1Fs/7/pHRyT0YpvmGoSK3S7qrsxe70seeEs+LF6N0QXCXoaeNB0xBL6xMjN +HRHDBikrroKmRJPbJvbW1RmLFHrasDWfDCb8BaUp7IoYSS62ayW/aqv4aB2FPBlqDwz cxRBgjIc+oiPoqs/Gmgop48UY8Z6OIvMNG+pgddBvsu21klCJdBWiDJW/Z/EhxATEB1t F2YC7Dx1scU/z+eGNf101jBcY/qgxhcqPuRzhYY+fmQfsF/85hLivnqwMQITnqv8bK3u bTRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790024785; x=1790629585; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=e5qHde0DG0iGDJnHfYl3SHserU3q1V+JrrCFiXRle6c=; b=aFLksKeLxJdeqQPK/eH+pwWFwkbzRqjKD1nHO7jO4vlFgXa89HVRFKWktagQ595+/w wApFGpTQTQo1lGHrKafPvf8v5AYcYkZsuw1q86sBnmXlpQOUkHXGIpNei7ak1Fd3oCn4 P7qeQ2oS3QXJXP2j9swc3w7ts980oylY6nkP6tFoRFhS+Rcotw8NhbGwVrt8jIMDh5N6 6lzMsAE5Dx8mNb/9rOt65yxooGzDwgMwf3BfSMz7OpIcVnLotOyQO03L9U8/mKK5f3lj T1hMO4jG2QGNGNAPOdFCI5DiXzCa+2Jj4T9WTY5qgrYOaQ6aoi4hRYvzZwJDtukYounL sXew== X-Forwarded-Encrypted: i=1; AKwUvBwc9MOCgwBE4ecS4nN+21HB9qXeZahWItq/dv7xrGfDio5lonYWrbrafhas8/Xcrdljs/5g0VPIVvmWq2U=@vger.kernel.org X-Gm-Message-State: AFuF++kFWMR5vSaqKbkBSrrVk+YJeqjMgfBbxWBSbK3Gw1Pl3lqO0IKc YPfSDZy4GtYPlVvLITBeBxw/1tSfipSZfDwrPclEm/+RvEV0k8yNwyFoujHBhDZ+wfmQA2ZHhUt YfpMk2w== X-Received: from plrp17.prod.google.com ([2002:a17:902:b091:b0:2db:1a39:c145]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:1a90:b0:2dd:3d1a:6958 with SMTP id d9443c01a7336-2ddb1ab3a86mr181174905ad.6.1790024784833; Mon, 21 Sep 2026 14:06:24 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 21 Sep 2026 14:06:14 -0700 In-Reply-To: <20260921210616.1024168-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260921210616.1024168-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260921210616.1024168-4-seanjc@google.com> Subject: [PATCH v4 3/5] KVM: Only bind memslot to guest_memfd instance for CREATE operations From: Sean Christopherson To: Paolo Bonzini , Sean Christopherson Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Ackerley Tng , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For additional defense-in-depth, and to avoid having to handle impossible unwind scenarios when binding to a memslot fails, bind a memslot to a gmem instance only when for CREATE operations, i.e. don't attempt to establish a binding for MOVE and FLAGS_ONLY operations. And when FLAGS_ONLY operations are eventually supported (this is currently all dead code), creating a new binding would be incorrect; KVM instead needs to do a 1:1 replacement of the existing binding, i.e. FLAGS_ONLY will need its own dedicated handling. Update the relevant TODO to make a better guess as to what needs to be done to support toggling dirty logging for guest_memfd memslots. Because it's dead code, no functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson --- virt/kvm/kvm_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 24cf96840827..b417b1f7095f 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1752,10 +1752,10 @@ static void kvm_commit_memory_region(struct kvm *kv= m, kvm_destroy_dirty_bitmap(old); =20 /* - * Unbind the guest_memfd instance as needed; the @new slot has - * already created its own binding. TODO: Drop the WARN when - * dirty logging guest_memfd memslots is supported. Until then, - * flags-only changes on guest_memfd slots should be impossible. + * TODO: Drop the WARN and do the unbind() call only for MOVE + * when dirty logging guest_memfd memslots is supported. Until + * then, flags-only changes on guest_memfd slots should also be + * impossible; unbind the old memslot for defense-in-depth. */ if (WARN_ON_ONCE(old->flags & KVM_MEM_GUEST_MEMFD)) kvm_gmem_unbind(old); @@ -2116,7 +2116,7 @@ static int kvm_set_memory_region(struct kvm *kvm, new->npages =3D npages; new->flags =3D mem->flags; new->userspace_addr =3D mem->userspace_addr; - if (mem->flags & KVM_MEM_GUEST_MEMFD) { + if (change =3D=3D KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD)) { r =3D kvm_gmem_bind(kvm, new, mem->guest_memfd, mem->guest_memfd_offset); if (r) goto out; --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 18:41:54 2026 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E7CC503BF6 for ; Mon, 21 Sep 2026 21:06:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024788; cv=none; b=cgnhewKw1uGTJrGogL9ruaBqBLIa/LmOrORE0zOlb+q+eZ7MHWiLthkwPDlnPa/uDwQ5wDG+xr7TTG/EbnSiPIvj4KUzCwKqO2yApI2GF2lbHcCzxm5RDQSc0CrL/fF1tO80QJ+k3U4iOqgXQ/AMiB0y+gfCgrpLWlktOy2dvNk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024788; c=relaxed/simple; bh=CYYAcKPHXAFH7Y5AjQtLjJCtZzeCM4DuK/S80/6HmOU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=XW+CIt+HKYS43fxSiqwvdNsZKbIxL20jH/yBxl58arhl8LptfZWgC5FW2AmIUxf91gCHotu34d4YnDgqLSlji3hoQd3Cqo6H7XeM73pZy2du5QLWYJzv3T3QiEy7nSUZnPUCbC6ebDlo8tKU47UFdTC0OTvcUQbJS8pBL1oplM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nf9Beo+E; arc=none smtp.client-ip=209.85.216.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nf9Beo+E" Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-39deda201bcso4554030a91.2 for ; Mon, 21 Sep 2026 14:06:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790024787; x=1790629587; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=iDR9vXlRAx9NrdlF8eqo04imbFcW8giz4Pk14RgnJc8=; b=nf9Beo+EYAMwRmK173oNn6P3ciSi18twi4wQ/zg+Pu5bIV1wovshZtATgr1DevAn8o nJoSAzpWGhptQUp9/FoEU0ZU1ySNcXXoj4EjJV1k80y/VmUnKeNHZYSMpHukwfBdVYhn ATmV0/oTTq5ku1mZ5y4Bug7RuBiTQItmddCEm9YkdX6UgJQHSZpg7QxdUei3jlHCHJqO KhovCBA/vUsS7BvaRjIfd35w/eoYHJ/jAMGfUfv72ATIdFaVztYnwqMdhXdu5OfEdCk4 IoofjrQtld3gJhJ7I7qWLst4of4eQankYoY78ETJ5OKNOj+kI9Mz4UN0b+AscFXJ2hlW bO9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790024787; x=1790629587; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=iDR9vXlRAx9NrdlF8eqo04imbFcW8giz4Pk14RgnJc8=; b=CgNG1SymWsWfkLVE+C9CxtUOIUmvs4T55RS+/qqQiLSChiiZGUZ1H3TKEsYlXN6esV N8VTi/PHzI4wldqBV3Xt+ns1D9nd24z6Kjly9YD5n1VukRDmdmfWfCNimd8pDviRirQy L1cjKrCLcd7JPmzfLNHsAZ9O57ODbd8FCu7BQ4b4CovbNAfkZixpnohP3WoSxKkhPp/+ mw6RWMmIlFfAAh5KEbokrZCAyA7SvBDdfp3wdTCxWY4+IBD6pjt63vq7U7HlMBQXQ9az fi0Y8o06JqGA854rVDOYE9Usz7NSB/kDTHV01JUcICCi2vKpIwuVWrALe+0LKFxYnmjG FRgA== X-Forwarded-Encrypted: i=1; AKwUvBz3kBizPywebp2w8u6CnKaMHIG0aJYBZtrhN3Q28ay+RMEZWMKsFuNrvVg5jAfNGGj4QZTGXbcdchobIpY=@vger.kernel.org X-Gm-Message-State: AFuF++nvlWIQbswzI+N10QMFF3lVk/PsoKCjl7wJrxL8CqXb/c3A53LB 6HGQk9mMGZR3SFgfJcwkjl7l8qelTQn+nMyW53KzlbauaTHrr7dw8nU/Y6jzB1gN4JSwKP4cktY dlAGPTg== X-Received: from pjbft16.prod.google.com ([2002:a17:90b:f90:b0:3a0:4eb1:9d4b]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:5824:b0:39e:6a7f:1dc8 with SMTP id 98e67ed59e1d1-39e6a7f21femr11148963a91.36.1790024786217; Mon, 21 Sep 2026 14:06:26 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 21 Sep 2026 14:06:15 -0700 In-Reply-To: <20260921210616.1024168-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260921210616.1024168-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260921210616.1024168-5-seanjc@google.com> Subject: [PATCH v4 4/5] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready From: Sean Christopherson To: Paolo Bonzini , Sean Christopherson Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Ackerley Tng , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Wait to bind a memslot to a guest_memfd instance until *after* the memslot is fully prepared, as creating the binding in guest_memfd will effectively expose the memslot to readers. As pointed out by Sashiko, binding the memslot before it's ready to be exposed to the rest of the world can break various memslot assumption and rules. E.g. x86 could observe a NULL rmap pointer if a PUNCH_HOLE hit the guest_memfd after the binding was created, but before KVM made it through kvm_prepare_memory_region(). Begrudgingly resort to passing in the guest_memfd fd+offset pair to kvm_set_memslot(), as creating the binding really does need to happen in the middle of setting the new memslot. Alternatively, to preserve the aesthetically pleasing function prototype, "struct kvm_memory_slot" could be expanded to track the fd and the file, but that would create the possibility for TOCTOU bugs on the fd vs. file, and would add zero value beyond making kvm_set_memslot() look pretty. Fixes:a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-spec= ific backing memory") Cc: stable@vger.kernel.org Reported-by: Sashiko Bot Closes: https://lore.kernel.org/all/20260826170551.BEF801F000E9@smtp.kernel= .org Signed-off-by: Sean Christopherson --- virt/kvm/kvm_main.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index b417b1f7095f..cc79a33a7d39 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1897,7 +1897,8 @@ static void kvm_update_flags_memslot(struct kvm *kvm, static int kvm_set_memslot(struct kvm *kvm, struct kvm_memory_slot *old, struct kvm_memory_slot *new, - enum kvm_mr_change change) + enum kvm_mr_change change, + unsigned int gmem_fd, uoff_t gmem_offset) { struct kvm_memory_slot *invalid_slot; int r; @@ -1944,6 +1945,15 @@ static int kvm_set_memslot(struct kvm *kvm, if (r) goto err; =20 + if (change =3D=3D KVM_MR_CREATE && (new->flags & KVM_MEM_GUEST_MEMFD)) { + r =3D kvm_gmem_bind(kvm, new, gmem_fd, gmem_offset); + if (r) { + kvm_arch_free_memslot(kvm, new); + kvm_destroy_dirty_bitmap(new); + goto err; + } + } + /* * For DELETE and MOVE, the working slot is now active as the INVALID * version of the old slot. MOVE is particularly special as it reuses @@ -2069,7 +2079,7 @@ static int kvm_set_memory_region(struct kvm *kvm, if (WARN_ON_ONCE(kvm->nr_memslot_pages < old->npages)) return -EIO; =20 - return kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE); + return kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE, -1, 0); } =20 base_gfn =3D (mem->guest_phys_addr >> PAGE_SHIFT); @@ -2116,21 +2126,14 @@ static int kvm_set_memory_region(struct kvm *kvm, new->npages =3D npages; new->flags =3D mem->flags; new->userspace_addr =3D mem->userspace_addr; - if (change =3D=3D KVM_MR_CREATE && (mem->flags & KVM_MEM_GUEST_MEMFD)) { - r =3D kvm_gmem_bind(kvm, new, mem->guest_memfd, mem->guest_memfd_offset); - if (r) - goto out; - } =20 - r =3D kvm_set_memslot(kvm, old, new, change); + r =3D kvm_set_memslot(kvm, old, new, change, + mem->guest_memfd, mem->guest_memfd_offset); if (r) - goto out_unbind; + goto out; =20 return 0; =20 -out_unbind: - if (mem->flags & KVM_MEM_GUEST_MEMFD) - kvm_gmem_unbind(new); out: kfree(new); return r; --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 18:41:54 2026 Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98F93509EE2 for ; Mon, 21 Sep 2026 21:06:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024789; cv=none; b=c1qYzM3sHagQrP6dA4Bo7LmQ8xb4O0PH4BiHrO+XdoV9ppwDX2hWdHHWileokvi6saQI1T0tRrsJgmH8FU8Moe4v7/aqRsKhOmIl2r+7u3NL2HOvVY7PMHlDbx29/tZWqEBaupW+zzT1UHq+HBT4Yk21nmEijQtUNHWe3O0Yznc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790024789; c=relaxed/simple; bh=NiYO9u22M0EOKTPmFi+as9af++RPLwF2dk3axMotfZ0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Q8NNye/FQVhHTdeyh/NI3SUBlzR0BuMyiRRDwwzMGQjs/yCkCaTY6K6CcvLPhUrzoNss+u+TD9dMk9tjZUMTrzoSvqhEoAY21/tCgfPevQhOA3p3g7DLu7yEB6zCOrHx9Xyi2WfRRnNpr0ZwxOZq5Dx1oDQrX4JsrJ430MRWg3I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=YvfM+/tn; arc=none smtp.client-ip=209.85.210.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="YvfM+/tn" Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-86a880e91f0so5985211b3a.2 for ; Mon, 21 Sep 2026 14:06:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790024788; x=1790629588; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aMnK3YE9JmuSMLmY/xn/2iknwP8QiqPv8uY0jyKuvFE=; b=YvfM+/tnxTZvUs5KDVsIEMal2RzJYOJIw38pUHMvYRMDzNJe/hJeK0ioviTJm/Wfso XV5nkHVHX9q3MYODgevmXPiF/uo1HcLDq7jadlfipWqyINlPglfrUhJf6qCNdJVICwRV o0k7Hl+DLFQBvJf521DGbN+7ZWwx6gwYkI5PKK4Tixrh2P8xrYcQrHt4eZFWFewvUvRF 5K3mQvQMV1AGh7VBOgScX0bk+gG09+enXDyUUsp+SUETyh1DeezUmMRfuoQrdE9xb3eH rDJ7s7A9I2DhYlm8wBOEr4Q9hhQCeyPf7i2O6DsFBnxQN0CrzlCFGrjiURYn7RISBDab y5BQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790024788; x=1790629588; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=aMnK3YE9JmuSMLmY/xn/2iknwP8QiqPv8uY0jyKuvFE=; b=rLk0QMD8WoyQofP42UYLPB67dSDhq/sRJULHJ3cw4HQ1nNlPQ38MN+pARwxmQ9WNvs Q2ceGaGBFrXmvyCVAgwWia3YPwCC9p1hrT2/N7ugxp81UaUk12CqZlf55sZXrA8lLlQQ 3vRbqc1h1JgBMWoW3Y8P2Kyfuq6dkFTQ43LDtpVXwru8v9uOPlhTyQGd4Zo3tFqUwgY7 ap4rFifBoM+kB0mhmodKeE/luOjzBhIF6//NE+ypTTvQBOz39w3tY+a2pAN4xcRqujDk CtLC/mHT9qABZ35vkR81Bu3LwrUM9WMmY+Z1B1izMXw0NFqx71UsbaM4v7prcbf7pzNQ f77w== X-Forwarded-Encrypted: i=1; AKwUvBypbb7nt/CMx0ORY8LgZBfwY2q13/CKphJbAJkFVH304ZcYLfRGc9SOemkhxXTstpqCKNn/uE33L7fUBSc=@vger.kernel.org X-Gm-Message-State: AFuF++n3GRLdkQH63YNz1xa01TZ7IPdOWWebd/hBuYfZOpBWt7D18VCZ /KMHBx60DY8tLpRPK9ltlY8pptI0NI88v2PgHOtsx6pWBO5yMiuC8ipdvmAzeiFb+JWhRy6nMD+ EREj4hA== X-Received: from pfbgd4.prod.google.com ([2002:a05:6a00:8304:b0:87a:ea08:6067]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:9504:b0:879:56df:91e with SMTP id d2e1a72fcca58-87956df0d09mr5762408b3a.41.1790024787615; Mon, 21 Sep 2026 14:06:27 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 21 Sep 2026 14:06:16 -0700 In-Reply-To: <20260921210616.1024168-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260921210616.1024168-1-seanjc@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260921210616.1024168-6-seanjc@google.com> Subject: [PATCH v4 5/5] KVM: guest_memfd: Drop superfluous WRITE_ONCE() when binding a memslot From: Sean Christopherson To: Paolo Bonzini , Sean Christopherson Cc: David Hildenbrand , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Stefan Teodorescu , Dennis Tighe , Sashiko Bot , Ackerley Tng , Yan Zhao Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Drop the superfluous WRITE_ONCE() when setting a memslot's guest_memfd file during initial binding, as the memslot *must* be inactive and unreachable. The superfluous WRITE_ONCE() was added by commit 67b43038ce14 ("KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file") to maintain rough "parity" with the existing rcu_assign_pointer(), not realizing that the only reason rcu_assign_pointer() was used was to make sparse and other checkers happy. Cc: Yan Zhao Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ackerley Tng Signed-off-by: Sean Christopherson --- virt/kvm/guest_memfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c index c094611f7c7a..11795ffe5830 100644 --- a/virt/kvm/guest_memfd.c +++ b/virt/kvm/guest_memfd.c @@ -690,7 +690,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_sl= ot *slot, * kvm_gmem_bind() must occur on a new memslot. Because the memslot * is not visible yet, kvm_gmem_get_pfn() is guaranteed to see the file. */ - WRITE_ONCE(slot->gmem.file, file); + slot->gmem.file =3D file; slot->gmem.pgoff =3D start; if (kvm_gmem_supports_mmap(inode)) slot->flags |=3D KVM_MEMSLOT_GMEM_ONLY; --=20 2.55.0.1082.g2b9226bbc0-goog