For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The kvm_gmem_fault_user_mapping() function currently triggers a warning
when it receives large folios, as indicated by the WARN_ON_ONCE() at
line 416. The code comment in kvm_gmem_get_folio() clearly states
"TODO: Support huge pages", indicating that large folio support is not
yet implemented.
Without explicitly restricting the folio order, filemap_grab_folio() may
opportunistically allocate large folios when memory is available, causing
the warning to trigger and the page fault to fail with VM_FAULT_SIGBUS.
Fix this by explicitly setting the mapping's folio order range to (0, 0)
during inode initialization in __kvm_gmem_create(), ensuring only order-0
(single-page) folios are allocated until proper large folio support is
added.
Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
virt/kvm/guest_memfd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..679814ec1874 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -596,7 +596,7 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
inode->i_mode |= S_IFREG;
inode->i_size = size;
mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
- mapping_set_inaccessible(inode->i_mapping);
+ mapping_set_folio_order_range(inode->i_mapping, 0, 0);
/* Unmovable mappings are supposed to be marked unevictable as well. */
WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
--
2.43.0