linux-kernel - Forwarded: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <697ee91f.050a0220.1d0a41.0015.GAE@google.com>
Date: Sat, 31 Jan 2026 21:48:15 -0800
From: syzbot <syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until
 large folio support is implemented

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The kvm_gmem_fault_user_mapping() function currently triggers a warning
when it receives large folios, as indicated by the WARN_ON_ONCE() at
line 416. The code comment in kvm_gmem_get_folio() clearly states
"TODO: Support huge pages", indicating that large folio support is not
yet implemented.

Without explicitly restricting the folio order, filemap_grab_folio() may
opportunistically allocate large folios when memory is available, causing
the warning to trigger and the page fault to fail with VM_FAULT_SIGBUS.

Fix this by explicitly setting the mapping's folio order range to (0, 0)
during inode initialization in __kvm_gmem_create(), ensuring only order-0
(single-page) folios are allocated until proper large folio support is
added.

Reproducer: mlock() on memory backed by guest_memfd with
GUEST_MEMFD_FLAG_INIT_SHARED triggers the warning when large folios
are allocated.

Add debug logging to track folio order configuration and allocation
for further investigation.

Reported-by: syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@...il.com>
---
 virt/kvm/guest_memfd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..e513e0f735d0 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -412,7 +412,8 @@ static vm_fault_t kvm_gmem_fault_user_mapping(struct vm_fault *vmf)

 		return vmf_error(PTR_ERR(folio));
 	}
-
+	pr_info("KVM: fault got folio, large=%d order=%u\n",
+	folio_test_large(folio), folio_order(folio));
 	if (WARN_ON_ONCE(folio_test_large(folio))) {
 		ret = VM_FAULT_SIGBUS;
 		goto out_folio;
@@ -596,6 +597,10 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
 	inode->i_mode |= S_IFREG;
 	inode->i_size = size;
 	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
+	mapping_set_folio_order_range(inode->i_mapping, 0, 0);
+	pr_info("KVM: guest_memfd created, folio_order min=%u max=%u\n",
+	mapping_min_folio_order(inode->i_mapping),
+	mapping_max_folio_order(inode->i_mapping));
 	mapping_set_inaccessible(inode->i_mapping);
 	/* Unmovable mappings are supposed to be marked unevictable as well. */
 	WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
-- 
2.43.0