Re: [PATCH v4 4/5] KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64 guest_memfd creation always fails with -EINVAL
--

commit 4ef8ddb233e05072a60b26ea82b2f5c73a298a71
Author: Sean Christopherson <seanjc@google.com>

KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready

This patch delays binding a memslot to a guest_memfd instance until after
the memslot is prepared. It accomplishes this by moving the kvm_gmem_bind()
call directly into kvm_set_memslot(), running it after the call to
kvm_prepare_memory_region().

Closes: https://lore.kernel.org/all/20260826170551.BEF801F000E9@smtp.kernel.org

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
[ ... ]
> @@ -1944,6 +1945,15 @@ static int kvm_set_memslot(struct kvm *kvm,
>  	r = kvm_prepare_memory_region(kvm, old, new, change);
>  	if (r)
>  		goto err;
>  
> +	if (change == KVM_MR_CREATE && (new->flags & KVM_MEM_GUEST_MEMFD)) {
> +		r = kvm_gmem_bind(kvm, new, gmem_fd, gmem_offset);

[Severity: High]
Does this new initialization order break guest_memfd creation on arm64?

By moving the kvm_gmem_bind() call to execute after kvm_prepare_memory_region(),
the KVM_MEMSLOT_GMEM_ONLY flag is not populated in time for the architecture
specific hooks.

In virt/kvm/guest_memfd.c:kvm_gmem_bind(), the flag is assigned:

    if (kvm_gmem_supports_mmap(inode))
        slot->flags |= KVM_MEMSLOT_GMEM_ONLY;

Because kvm_prepare_memory_region() now runs before this assignment, the
architecture hook in arch/arm64/kvm/mmu.c:kvm_arch_prepare_memory_region()
evaluates the flag before it is set:

    if (kvm_slot_has_gmem(new) && !kvm_memslot_is_gmem_only(new))
        return -EINVAL;

Will this cause all userspace attempts to create a guest_memfd memslot via
KVM_SET_USER_MEMORY_REGION2 on arm64 to unconditionally fail with -EINVAL?

> +		if (r) {
> +			kvm_arch_free_memslot(kvm, new);
> +			kvm_destroy_dirty_bitmap(new);
> +			goto err;
> +		}
> +	}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921210616.1024168-1-seanjc@google.com?part=4