linux-kernel - Forwarded: [PATCH] KVM: guest_memfd: Prevent THP collapse of guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <69893ea9.050a0220.3b3015.0064.GAE@google.com>
Date: Sun, 08 Feb 2026 17:55:53 -0800
From: syzbot <syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] KVM: guest_memfd: Prevent THP collapse of
 guest_memfd pages

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] KVM: guest_memfd: Prevent THP collapse of guest_memfd pages
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

guest_memfd fault handler kvm_gmem_fault_user_mapping() does not support
large folios and warns via WARN_ON_ONCE(folio_test_large(folio)).

When a guest_memfd mapping has VM_HUGEPAGE set via madvise(MADV_HUGEPAGE),
khugepaged or MADV_COLLAPSE can collapse small pages into a large folio
in the page cache. This happens because file_thp_enabled() incorrectly
returns true for guest_memfd inodes when CONFIG_READ_ONLY_THP_FOR_FS is
enabled. A subsequent page fault finds the large folio and triggers the
warning.

Fix this by setting VM_NO_KHUGEPAGED on the VMA in kvm_gmem_mmap().
This causes __thp_vma_allowable_orders() to reject THP early for both
MADV_COLLAPSE and khugepaged. The page fault path is unaffected since
guest_memfd does not define a huge_fault handler.

Reported-by: syzbot+33a04338019ac7e43a44@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@...il.com>
---
 virt/kvm/guest_memfd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..94ac360afe79 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -474,12 +474,13 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	if (!kvm_gmem_supports_mmap(file_inode(file)))
 		return -ENODEV;
-
+	
 	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) !=
 	    (VM_SHARED | VM_MAYSHARE)) {
 		return -EINVAL;
 	}

+	vm_flags_set(vma, VM_NO_KHUGEPAGED);
 	vma->vm_ops = &kvm_gmem_vm_ops;

 	return 0;
-- 
2.43.0