For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] KVM: guest_memfd: Prevent THP collapse of guest_memfd pages
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
guest_memfd fault handler kvm_gmem_fault_user_mapping() does not support
large folios and warns via WARN_ON_ONCE(folio_test_large(folio)).
When a guest_memfd mapping has VM_HUGEPAGE set via madvise(MADV_HUGEPAGE),
khugepaged or MADV_COLLAPSE can collapse small pages into a large folio
in the page cache. This happens because file_thp_enabled() incorrectly
returns true for guest_memfd inodes when CONFIG_READ_ONLY_THP_FOR_FS is
enabled. A subsequent page fault finds the large folio and triggers the
warning.
Fix this by setting VM_NO_KHUGEPAGED on the VMA in kvm_gmem_mmap().
This causes __thp_vma_allowable_orders() to reject THP early for both
MADV_COLLAPSE and khugepaged. The page fault path is unaffected since
guest_memfd does not define a huge_fault handler.
Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
virt/kvm/guest_memfd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..94ac360afe79 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -474,12 +474,13 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
{
if (!kvm_gmem_supports_mmap(file_inode(file)))
return -ENODEV;
-
+
if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) !=
(VM_SHARED | VM_MAYSHARE)) {
return -EINVAL;
}
+ vm_flags_set(vma, VM_NO_KHUGEPAGED);
vma->vm_ops = &kvm_gmem_vm_ops;
return 0;
--
2.43.0