Re: [PATCH RFC 02/17] KVM: guest_memfd: Support provider folio allocation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: kvm_gmem_get_folio() fails to retry on -EEXIST
--

commit 445058fdb485b40ed9956aa2d77439d304e8462d
Author: Ackerley Tng <ackerleytng@google.com>

KVM: guest_memfd: Support provider folio allocation

This commit introduces support for provider folio allocation in guest_memfd.
If created with a provider, guest_memfd uses it to allocate folios and inserts
them into its own filemap.

> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c
> @@ -140,10 +155,29 @@ static struct folio *kvm_gmem_get_folio(struct inode *inode, pgoff_t index)
[ ... ]
> +	if (gi->provider_ops) {
> +		folio = gmem_provider_alloc_folio(gi, index, policy);
> +		if (!IS_ERR(folio)) {
> +			int r = filemap_add_folio(inode->i_mapping, folio,
> +						  index, GFP_KERNEL);
> +			if (r) {
> +				folio_put(folio);
> +				folio = ERR_PTR(r);
> +			} else {

[Severity: High]
Does this code handle concurrent faults correctly?  When multiple vCPUs
concurrently fault on the same unmapped guest_memfd page, they will both
attempt to allocate and add a folio to the page cache.

The first one will succeed, but the subsequent ones will receive -EEXIST from
filemap_add_folio().

Since kvm_gmem_get_folio() traps the -EEXIST error here and converts it
directly into a terminal error rather than triggering a cache lookup retry,
it propagates the -EEXIST error up to KVM's page fault handler.

Can this cause an unexpected failure (KVM_EXIT_MEMORY_FAULT) and crash the VM,
allowing an unprivileged guest to trigger a denial of service?

> +				folio_mark_accessed(folio);
> +			}
> +		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925-gmem-tmpfs-backend-v1-0-d36159822d18@google.com?part=2