Forwarded: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented

[syzbot <syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] KVM: guest_memfd: Restrict to order-0 folios until large folio support is implemented
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


The kvm_gmem_fault_user_mapping() function currently triggers a warning
when it receives large folios, as indicated by the WARN_ON_ONCE() at
line 416. The code comment in kvm_gmem_get_folio() clearly states
"TODO: Support huge pages", indicating that large folio support is not
yet implemented.

Without explicitly restricting the folio order, filemap_grab_folio() may
opportunistically allocate large folios when memory is available, causing
the warning to trigger and the page fault to fail with VM_FAULT_SIGBUS.

Fix this by explicitly setting the mapping's folio order range to (0, 0)
during inode initialization, ensuring only order-0 (single-page) folios
are allocated until proper large folio support is added.

Reproducer: mlock() on memory backed by guest_memfd with
GUEST_MEMFD_FLAG_INIT_SHARED triggers the warning when large folios
are allocated.

Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
 virt/kvm/guest_memfd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..4dc154b4b370 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -596,6 +596,7 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
 	inode->i_mode |= S_IFREG;
 	inode->i_size = size;
 	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
+	mapping_set_folio_order_range(inode->i_mapping, 0, 0);
 	mapping_set_inaccessible(inode->i_mapping);
 	/* Unmovable mappings are supposed to be marked unevictable as well. */
 	WARN_ON_ONCE(!mapping_unevictable(inode->i_mapping));
-- 
2.43.0