linux-kernel - Re: [PATCH v3 2/6] KVM: guest_memfd: Remove partial hugepage handling from kvm_gmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260115204248.q234qzaj5f3flpw3@amd.com>
Date: Thu, 15 Jan 2026 14:42:48 -0600
From: Michael Roth <michael.roth@....com>
To: Sean Christopherson <seanjc@...gle.com>
CC: <kvm@...r.kernel.org>, <linux-coco@...ts.linux.dev>, <linux-mm@...ck.org>,
	<linux-kernel@...r.kernel.org>, <thomas.lendacky@....com>,
	<pbonzini@...hat.com>, <vbabka@...e.cz>, <ashish.kalra@....com>,
	<liam.merwick@...cle.com>, <david@...hat.com>, <vannapurve@...gle.com>,
	<ackerleytng@...gle.com>, <aik@....com>, <ira.weiny@...el.com>,
	<yan.y.zhao@...el.com>, <pankaj.gupta@....com>, Kai Huang
	<kai.huang@...el.com>
Subject: Re: [PATCH v3 2/6] KVM: guest_memfd: Remove partial hugepage
 handling from kvm_gmem_populate()

On Thu, Jan 15, 2026 at 11:17:18AM -0800, Sean Christopherson wrote:
> On Thu, Jan 08, 2026, Michael Roth wrote:
> > diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> > index fdaea3422c30..9dafa44838fe 100644
> > --- a/virt/kvm/guest_memfd.c
> > +++ b/virt/kvm/guest_memfd.c
> > @@ -151,6 +151,15 @@ static struct folio *kvm_gmem_get_folio(struct inode *inode, pgoff_t index)
> >  					 mapping_gfp_mask(inode->i_mapping), policy);
> >  	mpol_cond_put(policy);
> >  
> > +	/*
> > +	 * External interfaces like kvm_gmem_get_pfn() support dealing
> > +	 * with hugepages to a degree, but internally, guest_memfd currently
> > +	 * assumes that all folios are order-0 and handling would need
> > +	 * to be updated for anything otherwise (e.g. page-clearing
> > +	 * operations).
> > +	 */
> > +	WARN_ON_ONCE(folio_order(folio));
> 
> Gah, this is buggy.  __filemap_get_folio_mpol() can return an ERR_PTR().  If that
> happens, this WARN will dereference garbage and explode.
> 
> And of course I find it _just_ after sending thank yous, *sigh*.
> 
> I'll squash to this (after testing):
> 
> 	WARN_ON_ONCE(!IS_ERR(folio) && folio_order(folio));
> 
> avoiding a few emails isn't worth having a lurking bug.

Thanks for the catch. FWIW I double-checked that kvm_gmem_get_folio() always
returns an ERR_PTR() instead of NULL directly, so the suggested change looks
good to me.

-Mike