linux-kernel - Re: [PATCH] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <176227766483.3932613.3439641824887004985.b4-ty@google.com>
Date: Tue,  4 Nov 2025 09:45:04 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzbot+2479e53d0db9b32ae2aa@...kaller.appspotmail.com, 
	Hillf Danton <hdanton@...a.com>
Subject: Re: [PATCH] KVM: guest_memfd: Remove bindings on memslot deletion
 when gmem is dying

On Mon, 03 Nov 2025 17:12:05 -0800, Sean Christopherson wrote:
> When unbinding a memslot from a guest_memfd instance, remove the bindings
> even if the guest_memfd file is dying, i.e. even if its file refcount has
> gone to zero.  If the memslot is freed before the file is fully released,
> nullifying the memslot side of the binding in kvm_gmem_release() will
> write to freed memory, as detected by syzbot+KASAN:
> 
>   ==================================================================
>   BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353
>   Write of size 8 at addr ffff88807befa508 by task syz.0.17/6022
> 
> [...]

Applied to kvm-x86 fixes, with a tweaked comment to clarify that the bindings
and file haven't yet been destroyed/freed (and can't be destroyed/freed
concurrently either).

	/*
	 * However, if the file is _being_ closed, then the bindings need to be
	 * removed as kvm_gmem_release() might not run until after the memslot
	 * is freed.  Note, modifying the bindings is safe even though the file
	 * is dying as kvm_gmem_release() nullifies slot->gmem.file under
	 * slots_lock, and only puts its reference to KVM after destroying all
	 * bindings.  I.e. reaching this point means kvm_gmem_release() hasn't
	 * yet destroyed the bindings or freed the gmem_file, and can't do so
	 * until the caller drops slots_lock.
	 */

Thanks!

[1/1] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
      https://github.com/kvm-x86/linux/commit/ae431059e75d

--
https://github.com/kvm-x86/linux/tree/next