For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The kvm_gmem_fault_user_mapping() function currently triggers a warning
when it receives large folios, as indicated by the WARN_ON_ONCE() at
line 416. The code comment in kvm_gmem_get_folio() clearly states
"TODO: Support huge pages", indicating that large folio support is not
yet implemented.
Without explicitly restricting the folio order, filemap_grab_folio() may
opportunistically allocate large folios when memory is available, causing
the warning to trigger and the page fault to fail with VM_FAULT_SIGBUS.
Fix this by explicitly setting the mapping's folio order range to (0, 0)
during inode initialization in __kvm_gmem_create(), ensuring only order-0
(single-page) folios are allocated until proper large folio support is
added.
Reproducer: mlock() on memory backed by guest_memfd with
GUEST_MEMFD_FLAG_INIT_SHARED triggers the warning when large folios
are allocated.
Add debug logging to track folio order configuration and allocation
for further investigation.
Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
virt/kvm/guest_memfd.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..e513e0f735d0 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -412,7 +412,8 @@ static vm_fault_t kvm_gmem_fault_user_mapping(struct vm_fault *vmf)
return vmf_error(PTR_ERR(folio));
}
-
+ pr_info("KVM: fault got folio, large=%d order=%u\n",
+ folio_test_large(folio), folio_order(folio));
if (WARN_ON_ONCE(folio_test_large(folio))) {
ret = VM_FAULT_SIGBUS;
goto out_folio;
@@ -596,6 +597,10 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
inode->i_mode |= S_IFREG;
inode->i_size = size;
mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
+ mapping_set_folio_order_range(inode->i_mapping, 0, 0);
+ pr_info("KVM: guest_memfd created, folio_order min=%u max=%u\n",
+ mapping_min_folio_order(inode->i_mapping),
+ mapping_max_folio_order(inode->i_mapping));
mapping_set_inaccessible(inode->i_mapping);
/* Unmovable mappings are supposed to be marked unevictable as well. */
WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
--
2.43.0