Re: [PATCH RFC v3 06/88] KVM: selftests: Add helper to create guest_memfd with a resource file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] KVM: guest_memfd: missing release_folio() with
  mapping_set_release_always()
- [Medium] mm: shmem: unmovable guest_memfd folios allocated with
  GFP_HIGHUSER_MOVABLE
--

commit a3e5841f5c68c0e42d4540b30c82c6fced7d8d4f
Author: Ackerley Tng <ackerleytng@google.com>

KVM: selftests: Add helper to create guest_memfd with a resource file

This commit syncs the KVM UAPI header for GUEST_MEMFD_FLAG_USE_RESOURCE and
adds selftest helpers to create a guest_memfd instance backed by a resource
file descriptor.

> diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
> index e2618877619e1..eca296539db79 100644
> --- a/tools/testing/selftests/kvm/include/kvm_util.h
> +++ b/tools/testing/selftests/kvm/include/kvm_util.h
> @@ -809,26 +809,39 @@ static inline bool is_smt_on(void)
>  
>  void vm_create_irqchip(struct kvm_vm *vm);
>  
> -static inline int __vm_create_guest_memfd(struct kvm_vm *vm, u64 size,
> -					  u64 flags)
> +static inline int __vm_create_guest_memfd_resource(struct kvm_vm *vm, u64 size,
> +						   u64 flags, int resource_fd)
>  {
>  	struct kvm_create_guest_memfd guest_memfd = {
>  		.size = size,
>  		.flags = flags,
> +		.resource_fd = resource_fd,
>  	};
>  
>  	return __vm_ioctl(vm, KVM_CREATE_GUEST_MEMFD, &guest_memfd);
>  }

[Severity: High]
In the underlying kernel support for provider folio invalidation added
earlier in this series in commit "KVM: guest_memfd: Support provider folio
invalidation", kvm_gmem_init_inode() calls
mapping_set_release_always(inode->i_mapping), but kvm_gmem_aops does not
implement .release_folio.  Can this cause mapping_evict_folio() to warn and
evict guest_memfd folios without invalidating KVM MMU mappings or provider
accounting?

Because AS_RELEASE_ALWAYS is set, folio_needs_release() is true in
filemap_release_folio(), which falls back to try_to_free_buffers() when
a_ops->release_folio is NULL:

fs/buffer.c:try_to_free_buffers() {
	/* Misconfigured folio check */
	if (WARN_ON_ONCE(!folio_buffers(folio)))
		return true;

When soft_offline_in_use_page() calls mapping_evict_folio() on a clean,
unmapped guest_memfd folio, filemap_release_folio() triggers that warning
and returns true.  mapping_evict_folio() then removes the folio from the
page cache without calling kvm_gmem_invalidate_folio() or notifying the
KVM MMU, leaving stage-2 page tables pointing to the freed page and leaking
tmpfs provider block accounting.

> -static inline int vm_create_guest_memfd(struct kvm_vm *vm, u64 size,
> -					u64 flags)
> +static inline int __vm_create_guest_memfd(struct kvm_vm *vm, u64 size,
> +					  u64 flags)
> +{
> +	return __vm_create_guest_memfd_resource(vm, size, flags, 0);
> +}
> +
> +static inline int vm_create_guest_memfd_resource(struct kvm_vm *vm, u64 size,
> +						 u64 flags, int resource_fd)
>  {
> -	int fd = __vm_create_guest_memfd(vm, size, flags);
> +	int fd = __vm_create_guest_memfd_resource(vm, size, flags, resource_fd);
>  
>  	TEST_ASSERT(fd >= 0, KVM_IOCTL_ERROR(KVM_CREATE_GUEST_MEMFD, fd));
>  	return fd;
>  }

[Severity: Medium]
When a guest_memfd is created with a tmpfs resource_fd (via commit "mm:
shmem: Implement guest_memfd provider operations for tmpfs" earlier in this
series), does shmem_gmem_alloc_folio() place unmovable folios into
ZONE_MOVABLE or MIGRATE_CMA?

kvm_gmem_init_inode() sets GFP_HIGHUSER (without __GFP_MOVABLE) and marks
the mapping AS_INACCESSIBLE because guest_memfd folios cannot be migrated.
However, shmem_gmem_alloc_folio() allocates with GFP_HIGHUSER_MOVABLE:

mm/shmem.c:shmem_gmem_alloc_folio() {
	...
	if (mpol)
		folio = folio_alloc_mpol(GFP_HIGHUSER_MOVABLE, 0, mpol, index,
					 numa_node_id());
	else
		folio = folio_alloc(GFP_HIGHUSER_MOVABLE, 0);

Once kvm_gmem_get_folio() inserts the folio into the AS_INACCESSIBLE
guest_memfd mapping, migration is rejected, pinning the page in
ZONE_MOVABLE or CMA and breaking CMA allocations or memory hot-unplug.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-gmem-alternative-providers-v3-0-8484dde66a7e@google.com?part=6