[PATCH v2 0/3] KVM: Fix guest_memfd binding overlap errno and selftest

[PATCH v2 0/3] KVM: Fix guest_memfd binding overlap errno and selftest

[Sean Christopherson]

Fix a goof where KVM rejects guest_memfd bindings that overlap an existing
binding with EINVAL instead of the intended EEXIST, and then add that specific
scenario to testcase that's supposed to verify overlap checks.

v2:
 - Collect Ackerley's reviews.
 - Keep the GPA overlap testcases (because why not). [Sean]
 - Add a patch to remove superfluous %s formatting. [Ackerley]

v1: https://lore.kernel.org/all/20260518070943.2091287-1-ZongYao.Chen@linux.alibaba.com

Sean Christopherson (1):
  KVM: selftests: Remove unnecessary "%s" formatting of a constant
    string

Zongyao Chen (2):
  KVM: guest_memfd: Return -EEXIST for overlapping bindings
  KVM: selftests: Test guest_memfd binding overlap without GPA overlap

 .../selftests/kvm/set_memory_region_test.c    | 31 ++++++++++++++++---
 virt/kvm/guest_memfd.c                        |  1 +
 2 files changed, 28 insertions(+), 4 deletions(-)


base-commit: b7fbe9a1bf9ee6c967ef77d366ca58c35fcf1887
-- 
2.54.0.794.g4f17f83d09-goog

[PATCH v2 1/3] KVM: guest_memfd: Return -EEXIST for overlapping bindings

[Sean Christopherson]

From: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>

KVM_SET_USER_MEMORY_REGION2 rejects guest_memfd ranges that overlap an
existing binding, but kvm_gmem_bind() currently reports the failure through
its generic -EINVAL path.  That makes binding conflicts indistinguishable
from malformed guest_memfd parameters.

Return -EEXIST when the target guest_memfd range is already bound, matching
the errno used for overlapping GPA memslots and making the two types of
range conflicts report the same class of error to userspace.

Note, returning -EINVAL was definitely not intentional, as guest_memfd
support was accompanied by a selftest to verify that attempting to create
overlapping bindings fails with -EEXIST.  Except the selftest was also
flawed in that it unintentionally overlapped memslot GPAs, and so failed
on KVM's common memslot checks before reaching guest_memfd.

Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory")
Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Ackerley Tng <ackerleytng@google.com>
[sean: call out that the original intent was to return -EEXIST]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 virt/kvm/guest_memfd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index 69c9d6d546b2..46727539d08a 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -675,6 +675,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
 
 	if (!xa_empty(&f->bindings) &&
 	    xa_find(&f->bindings, &start, end - 1, XA_PRESENT)) {
+		r = -EEXIST;
 		filemap_invalidate_unlock(inode->i_mapping);
 		goto err;
 	}
-- 
2.54.0.794.g4f17f83d09-goog

[PATCH v2 2/3] KVM: selftests: Test guest_memfd binding overlap without GPA overlap

[Sean Christopherson]

From: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>

The guest_memfd binding overlap test recreates the deleted slot with GPA
ranges that overlap the still-live slot.  KVM rejects those attempts from
the generic memslot overlap check before reaching kvm_gmem_bind(), so the
test can pass even if guest_memfd binding overlap detection is broken.

Recreate the slot at its original, non-overlapping GPA and use guest_memfd
offsets that overlap the front and back halves of the other slot's binding.
Expand the guest_memfd so the back-half case remains within the file size.

Fixes: 2feabb855df8 ("KVM: selftests: Expand set_memory_region_test to validate guest_memfd()")
Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Ackerley Tng <ackerleytng@google.com>
[sean: keep the existing GPA overlap testcases]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 .../selftests/kvm/set_memory_region_test.c    | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/set_memory_region_test.c b/tools/testing/selftests/kvm/set_memory_region_test.c
index 9b919a231c93..be99c1ff5a5a 100644
--- a/tools/testing/selftests/kvm/set_memory_region_test.c
+++ b/tools/testing/selftests/kvm/set_memory_region_test.c
@@ -510,7 +510,7 @@ static void test_add_overlapping_private_memory_regions(void)
 
 	vm = vm_create_barebones_type(KVM_X86_SW_PROTECTED_VM);
 
-	memfd = vm_create_guest_memfd(vm, MEM_REGION_SIZE * 4, 0);
+	memfd = vm_create_guest_memfd(vm, MEM_REGION_SIZE * 5, 0);
 
 	vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
 				   MEM_REGION_GPA, MEM_REGION_SIZE * 2, 0, memfd, 0);
@@ -526,7 +526,30 @@ static void test_add_overlapping_private_memory_regions(void)
 	vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
 				   MEM_REGION_GPA, 0, NULL, -1, 0);
 
-	/* Overlap the front half of the other slot. */
+	/*
+	 * Verify that overlap in the guest_memfd bindings (i.e. in guest_memfd
+	 * file offsets), but _not_ in the GPA space, fails with -EEXIST.
+	 */
+	r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
+					 MEM_REGION_GPA,
+					 MEM_REGION_SIZE * 2,
+					 0, memfd, MEM_REGION_SIZE);
+	TEST_ASSERT(r == -1 && errno == EEXIST,
+		    "Overlapping guest_memfd() bindings should fail with EEXIST");
+
+	/* And now the back half of the other slot's guest_memfd binding. */
+	r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
+					 MEM_REGION_GPA,
+					 MEM_REGION_SIZE * 2,
+					 0, memfd, MEM_REGION_SIZE * 3);
+	TEST_ASSERT(r == -1 && errno == EEXIST,
+		    "Overlapping guest_memfd() bindings should fail with EEXIST");
+
+	/*
+	 * Repeat the overlap tests, but this time with overlap in the memslots
+	 * GPA space.  Regardless of where there is overlap, KVM should return
+	 * -EEXIST.
+	 */
 	r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
 					 MEM_REGION_GPA * 2 - MEM_REGION_SIZE,
 					 MEM_REGION_SIZE * 2,
-- 
2.54.0.794.g4f17f83d09-goog

[PATCH v2 3/3] KVM: selftests: Remove unnecessary "%s" formatting of a constant string

[Sean Christopherson]

Drop superfluous %s formatting from assertions in the guest_memfd overlap
testcases, as the string being printed doesn't require runtime formatting.

No functional change intended.

Reported-by: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 tools/testing/selftests/kvm/set_memory_region_test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/set_memory_region_test.c b/tools/testing/selftests/kvm/set_memory_region_test.c
index be99c1ff5a5a..e0800bfb11eb 100644
--- a/tools/testing/selftests/kvm/set_memory_region_test.c
+++ b/tools/testing/selftests/kvm/set_memory_region_test.c
@@ -554,7 +554,7 @@ static void test_add_overlapping_private_memory_regions(void)
 					 MEM_REGION_GPA * 2 - MEM_REGION_SIZE,
 					 MEM_REGION_SIZE * 2,
 					 0, memfd, 0);
-	TEST_ASSERT(r == -1 && errno == EEXIST, "%s",
+	TEST_ASSERT(r == -1 && errno == EEXIST,
 		    "Overlapping guest_memfd() bindings should fail with EEXIST");
 
 	/* And now the back half of the other slot. */
@@ -562,7 +562,7 @@ static void test_add_overlapping_private_memory_regions(void)
 					 MEM_REGION_GPA * 2 + MEM_REGION_SIZE,
 					 MEM_REGION_SIZE * 2,
 					 0, memfd, 0);
-	TEST_ASSERT(r == -1 && errno == EEXIST, "%s",
+	TEST_ASSERT(r == -1 && errno == EEXIST,
 		    "Overlapping guest_memfd() bindings should fail with EEXIST");
 
 	close(memfd);
-- 
2.54.0.794.g4f17f83d09-goog

Re: [PATCH v2 3/3] KVM: selftests: Remove unnecessary "%s" formatting of a constant string

[Ackerley Tng]

Sean Christopherson <seanjc@google.com> writes:

> Drop superfluous %s formatting from assertions in the guest_memfd overlap
> testcases, as the string being printed doesn't require runtime formatting.
>
> No functional change intended.
>
> Reported-by: Ackerley Tng <ackerleytng@google.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>  tools/testing/selftests/kvm/set_memory_region_test.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/kvm/set_memory_region_test.c b/tools/testing/selftests/kvm/set_memory_region_test.c
> index be99c1ff5a5a..e0800bfb11eb 100644
> --- a/tools/testing/selftests/kvm/set_memory_region_test.c
> +++ b/tools/testing/selftests/kvm/set_memory_region_test.c
> @@ -554,7 +554,7 @@ static void test_add_overlapping_private_memory_regions(void)
>  					 MEM_REGION_GPA * 2 - MEM_REGION_SIZE,
>  					 MEM_REGION_SIZE * 2,
>  					 0, memfd, 0);
> -	TEST_ASSERT(r == -1 && errno == EEXIST, "%s",
> +	TEST_ASSERT(r == -1 && errno == EEXIST,
>  		    "Overlapping guest_memfd() bindings should fail with EEXIST");
>
>  	/* And now the back half of the other slot. */
> @@ -562,7 +562,7 @@ static void test_add_overlapping_private_memory_regions(void)
>  					 MEM_REGION_GPA * 2 + MEM_REGION_SIZE,
>  					 MEM_REGION_SIZE * 2,
>  					 0, memfd, 0);
> -	TEST_ASSERT(r == -1 && errno == EEXIST, "%s",
> +	TEST_ASSERT(r == -1 && errno == EEXIST,
>  		    "Overlapping guest_memfd() bindings should fail with EEXIST");
>
>  	close(memfd);
> --
> 2.54.0.794.g4f17f83d09-goog

Reviewed-by: Ackerley Tng <ackerleytng@google.com>

Thanks!

Re: [PATCH v2 1/3] KVM: guest_memfd: Return -EEXIST for overlapping bindings

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of xa_store_range() is ignored in kvm_gmem_bind(), masking memory allocation failures and leading to a Use-After-Free vulnerability.
- [High] A signed integer overflow in the file size bounds check inside kvm_gmem_bind() allows userspace to map memslots beyond the allocated size of the guest_memfd.
--

commit 7edaac3f2255cc17c741557ce1e44f51d4cece29
Author: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>

KVM: guest_memfd: Return -EEXIST for overlapping bindings

This patch updates the KVM_SET_USER_MEMORY_REGION2 ioctl to return -EEXIST
instead of -EINVAL when a guest_memfd range overlaps an existing binding.
This aligns the error reporting with overlapping GPA memslots.

> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> index 69c9d6d546b28..46727539d08ac 100644
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c
> @@ -675,6 +675,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
>  
>  	if (!xa_empty(&f->bindings) &&
>  	    xa_find(&f->bindings, &start, end - 1, XA_PRESENT)) {
> +		r = -EEXIST;

[Severity: High]
This isn't a bug introduced by this patch, but looking at the bounds check
earlier in kvm_gmem_bind():

    if (offset < 0 || !PAGE_ALIGNED(offset) ||
        offset + size > i_size_read(inode))
        goto err;

Are these variables susceptible to a signed integer overflow?

Both offset and size are evaluated as loff_t values. If userspace provides an
offset close to the signed 64-bit maximum, adding size could wrap around to a
negative value.

Would this cause the offset + size > i_size_read(inode) condition to bypass
the file size limits and allow the guest to map memslots beyond the allocated
size?


[Severity: High]
This is also a pre-existing issue, but I noticed the return value of
xa_store_range() isn't checked later in kvm_gmem_bind():

    xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL);
    filemap_invalidate_unlock(inode->i_mapping);

If memory allocation fails and xa_store_range() returns an error pointer,
does the memslot get omitted from f->bindings while kvm_gmem_bind() still
proceeds as if it was successful?

When the guest_memfd is closed, kvm_gmem_release() nullifies active bindings
but would miss this omitted slot, leaving slot->gmem.file set while the VFS
frees the underlying file.

Later, when the VM is destroyed, could kvm_gmem_unbind() attempting to
access the memslot's file via get_file_active() trigger a use-after-free?

>  		filemap_invalidate_unlock(inode->i_mapping);
>  		goto err;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260522172151.3530267-1-seanjc@google.com?part=1

Re: [PATCH v2 1/3] KVM: guest_memfd: Return -EEXIST for overlapping bindings

[Ackerley Tng]

sashiko-bot@kernel.org writes:

> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] The return value of xa_store_range() is ignored in kvm_gmem_bind(), masking memory allocation failures and leading to a Use-After-Free vulnerability.
> - [High] A signed integer overflow in the file size bounds check inside kvm_gmem_bind() allows userspace to map memslots beyond the allocated size of the guest_memfd.
> --
>
> commit 7edaac3f2255cc17c741557ce1e44f51d4cece29
> Author: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
>
> KVM: guest_memfd: Return -EEXIST for overlapping bindings
>
> This patch updates the KVM_SET_USER_MEMORY_REGION2 ioctl to return -EEXIST
> instead of -EINVAL when a guest_memfd range overlaps an existing binding.
> This aligns the error reporting with overlapping GPA memslots.
>
>> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
>> index 69c9d6d546b28..46727539d08ac 100644
>> --- a/virt/kvm/guest_memfd.c
>> +++ b/virt/kvm/guest_memfd.c
>> @@ -675,6 +675,7 @@ int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,
>>
>>  	if (!xa_empty(&f->bindings) &&
>>  	    xa_find(&f->bindings, &start, end - 1, XA_PRESENT)) {
>> +		r = -EEXIST;
>
> [Severity: High]
> This isn't a bug introduced by this patch, but looking at the bounds check
> earlier in kvm_gmem_bind():
>
>     if (offset < 0 || !PAGE_ALIGNED(offset) ||
>         offset + size > i_size_read(inode))
>         goto err;
>
> Are these variables susceptible to a signed integer overflow?
>
> Both offset and size are evaluated as loff_t values. If userspace provides an
> offset close to the signed 64-bit maximum, adding size could wrap around to a
> negative value.
>
> Would this cause the offset + size > i_size_read(inode) condition to bypass
> the file size limits and allow the guest to map memslots beyond the allocated
> size?
>

This was also discussed in [1]. I'll send Sean's suggested fix for this.

[1] https://lore.kernel.org/all/ag8BmtzxTlcuA_zy@google.com/

>
> [Severity: High]
> This is also a pre-existing issue, but I noticed the return value of
> xa_store_range() isn't checked later in kvm_gmem_bind():
>
>     xa_store_range(&f->bindings, start, end - 1, slot, GFP_KERNEL);
>     filemap_invalidate_unlock(inode->i_mapping);
>
> If memory allocation fails and xa_store_range() returns an error pointer,
> does the memslot get omitted from f->bindings while kvm_gmem_bind() still
> proceeds as if it was successful?
>

Will send a fix for this too.

> When the guest_memfd is closed, kvm_gmem_release() nullifies active bindings
> but would miss this omitted slot, leaving slot->gmem.file set while the VFS
> frees the underlying file.
>
> Later, when the VM is destroyed, could kvm_gmem_unbind() attempting to
> access the memslot's file via get_file_active() trigger a use-after-free?
>
>>  		filemap_invalidate_unlock(inode->i_mapping);
>>  		goto err;
>>  	}
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260522172151.3530267-1-seanjc@google.com?part=1

Re: [PATCH v2 0/3] KVM: Fix guest_memfd binding overlap errno and selftest

[Sean Christopherson]

On Fri, 22 May 2026 10:21:48 -0700, Sean Christopherson wrote:
> Fix a goof where KVM rejects guest_memfd bindings that overlap an existing
> binding with EINVAL instead of the intended EEXIST, and then add that specific
> scenario to testcase that's supposed to verify overlap checks.
> 
> v2:
>  - Collect Ackerley's reviews.
>  - Keep the GPA overlap testcases (because why not). [Sean]
>  - Add a patch to remove superfluous %s formatting. [Ackerley]
> 
> [...]

Applied to kvm-x86 gmem, thanks!

[1/3] KVM: guest_memfd: Return -EEXIST for overlapping bindings
      https://github.com/kvm-x86/linux/commit/7ea987a90585
[2/3] KVM: selftests: Test guest_memfd binding overlap without GPA overlap
      https://github.com/kvm-x86/linux/commit/772989854acd
[3/3] KVM: selftests: Remove unnecessary "%s" formatting of a constant string
      https://github.com/kvm-x86/linux/commit/b0e476eb755e

--
https://github.com/kvm-x86/linux/tree/next