linux-kernel - Forwarded: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <697f054f.050a0220.16b13.009a.GAE@google.com>
Date: Sat, 31 Jan 2026 23:48:31 -0800
From: syzbot <syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until
 large folio support is implemented

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The kvm_gmem_fault_user_mapping() function currently triggers a warning
when it receives large folios, as indicated by the WARN_ON_ONCE() at
line 416. The code comment in kvm_gmem_get_folio() clearly states
"TODO: Support huge pages", indicating that large folio support is not
yet implemented.

Without explicitly restricting the folio order, filemap_grab_folio() may
opportunistically allocate large folios when memory is available, causing
the warning to trigger and the page fault to fail with VM_FAULT_SIGBUS.

Fix this by explicitly setting the mapping's folio order range to (0, 0)
during inode initialization in __kvm_gmem_create(), ensuring only order-0
(single-page) folios are allocated until proper large folio support is
added.

Reported-by: syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@...il.com>
---
 virt/kvm/guest_memfd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..679814ec1874 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -596,7 +596,7 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
 	inode->i_mode |= S_IFREG;
 	inode->i_size = size;
 	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
-	mapping_set_inaccessible(inode->i_mapping);
+	mapping_set_folio_order_range(inode->i_mapping, 0, 0);
 	/* Unmovable mappings are supposed to be marked unevictable as well. */
 	WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));

-- 
2.43.0