Re: [PATCH RFC 05/17] KVM: selftests: Add helper to create guest_memfd with a resource file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] kvm: UAPI backward compatibility break in kvm_gmem_create() validation
--

commit c5a56bcf1ec583a76fd38be9422edf93bea63235
Author: Ackerley Tng <ackerleytng@google.com>

    KVM: selftests: Add helper to create guest_memfd with a resource file
    
    Add a helper to create guest_memfd instances with a resource file
    descriptor, and update the existing creation helper to pass a zero
    resource file descriptor.

> diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
> index 419011097fa8e..66c1f40b50c29 100644
> --- a/tools/include/uapi/linux/kvm.h
> +++ b/tools/include/uapi/linux/kvm.h
> @@ -1654,11 +1654,14 @@ struct kvm_memory_attributes {
>  #define KVM_CREATE_GUEST_MEMFD	_IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)
>  #define GUEST_MEMFD_FLAG_MMAP		(1ULL << 0)
>  #define GUEST_MEMFD_FLAG_INIT_SHARED	(1ULL << 1)
> +#define GUEST_MEMFD_FLAG_USE_RESOURCE	(1ULL << 2)
>  
>  struct kvm_create_guest_memfd {
>  	__u64 size;
>  	__u64 flags;
> -	__u64 reserved[6];
> +	__s32 resource_fd;
> +	__u32 pad;
> +	__u64 reserved[5];

[Severity: Critical]
Does repurposing the reserved field introduce a UAPI regression?

Since the baseline kernel didn't enforce that the reserved array was
zero-initialized, older userspace applications might pass uninitialized memory
in args.reserved[0].

If a legacy application calls ioctl(fd, KVM_CREATE_GUEST_MEMFD, &args) without
setting GUEST_MEMFD_FLAG_USE_RESOURCE, the validation check in
virt/kvm/guest_memfd.c:kvm_gmem_create() will reject the call:

	if (!(flags & GUEST_MEMFD_FLAG_USE_RESOURCE) && args->resource_fd)
		return -EINVAL;

Should unvalidated reserved fields be silently ignored when the associated
feature flag is absent?

>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925-gmem-tmpfs-backend-v1-0-d36159822d18@google.com?part=5