| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/23 13:43 | flow | patch-triage |
8mArgs:null Results: {
"EnableConfigs": [
"KVM"
],
"FocusSymbols": [
"kvm_gmem_unbind"
],
"KMSANReasoning": "The patch modifies KVM guest_memfd selftests and fixes a locking/concurrency bug in `kvm_gmem_unbind` in `virt/kvm/guest_memfd.c`. The bug fix ensures that `filemap_invalidate_lock` is taken even when the file is dying, preventing a mismatch in `mmu_invalidate_in_progress` increments/decrements. This is a logic/concurrency issue, not an uninitialized memory read or info-leak. Therefore, KMSAN is not applicable, and standard KASAN/LOCKDEP testing is sufficient.",
"NeedsKMSAN": false,
"Reasoning": "The patch fixes a race condition in `kvm_gmem_unbind` when a guest_memfd file is being closed by ensuring the invalidate lock is taken even for dying files. This is a functional change in core KVM logic that is reachable from userspace and should be fuzzed.",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/23 13:43 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 132ccef91049e6df722ac0c3a9228aaa3de1509a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Aug 23 13:43:39 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c\nindex 2233d871a38f4..aee80dda62295 100644\n--- a/tools/testing/selftests/kvm/guest_memfd_test.c\n+++ b/tools/testing/selftests/kvm/guest_memfd_test.c\n@@ -76,33 +76,53 @@ static void test_mmap_supported(int fd, size_t total_size)\n \tkvm_munmap(mem, total_size);\n }\n \n+/*\n+ * Fill @nids with the first @nr_nids nodes in the allowed mask.\n+ * Return false if the mask contains fewer than @nr_nids nodes.\n+ */\n+static bool get_numa_node_ids(int *nids, int nr_nids)\n+{\n+\tunsigned long nodemask = get_numa_mem_nodes();\n+\tunsigned long nid;\n+\tint nr_found = 0;\n+\n+\tfor_each_set_bit(nid, \u0026nodemask, BITS_PER_TYPE(nodemask)) {\n+\t\tnids[nr_found++] = nid;\n+\t\tif (nr_found == nr_nids)\n+\t\t\treturn true;\n+\t}\n+\n+\treturn false;\n+}\n+\n static void test_mbind(int fd, size_t total_size)\n {\n-\tconst unsigned long nodemask_0 = 1; /* nid: 0 */\n-\tunsigned long nodemask = 0;\n-\tunsigned long maxnode = BITS_PER_TYPE(nodemask);\n+\tunsigned long nodemask, bind_nodemask;\n+\tunsigned long maxnode = BITS_PER_TYPE(nodemask) + 1;\n \tint policy;\n \tchar *mem;\n+\tint nid;\n \tint ret;\n \n-\tif (!is_multi_numa_node_system())\n+\tif (!get_numa_node_ids(\u0026nid, 1))\n \t\treturn;\n \n+\tbind_nodemask = 1UL \u003c\u003c nid;\n \tmem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);\n \n \t/* Test MPOL_INTERLEAVE policy */\n-\tkvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, \u0026nodemask_0, maxnode, 0);\n+\tkvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, \u0026bind_nodemask, maxnode, 0);\n \tkvm_get_mempolicy(\u0026policy, \u0026nodemask, maxnode, mem, MPOL_F_ADDR);\n-\tTEST_ASSERT(policy == MPOL_INTERLEAVE \u0026\u0026 nodemask == nodemask_0,\n+\tTEST_ASSERT(policy == MPOL_INTERLEAVE \u0026\u0026 nodemask == bind_nodemask,\n \t\t \"Wanted MPOL_INTERLEAVE (%u) and nodemask 0x%lx, got %u and 0x%lx\",\n-\t\t MPOL_INTERLEAVE, nodemask_0, policy, nodemask);\n+\t\t MPOL_INTERLEAVE, bind_nodemask, policy, nodemask);\n \n \t/* Test basic MPOL_BIND policy */\n-\tkvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, \u0026nodemask_0, maxnode, 0);\n+\tkvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, \u0026bind_nodemask, maxnode, 0);\n \tkvm_get_mempolicy(\u0026policy, \u0026nodemask, maxnode, mem + page_size * 2, MPOL_F_ADDR);\n-\tTEST_ASSERT(policy == MPOL_BIND \u0026\u0026 nodemask == nodemask_0,\n+\tTEST_ASSERT(policy == MPOL_BIND \u0026\u0026 nodemask == bind_nodemask,\n \t\t \"Wanted MPOL_BIND (%u) and nodemask 0x%lx, got %u and 0x%lx\",\n-\t\t MPOL_BIND, nodemask_0, policy, nodemask);\n+\t\t MPOL_BIND, bind_nodemask, policy, nodemask);\n \n \t/* Test MPOL_DEFAULT policy */\n \tkvm_mbind(mem, total_size, MPOL_DEFAULT, NULL, 0, 0);\n@@ -112,7 +132,7 @@ static void test_mbind(int fd, size_t total_size)\n \t\t MPOL_DEFAULT, policy, nodemask);\n \n \t/* Test with invalid policy */\n-\tret = mbind(mem, page_size, 999, \u0026nodemask_0, maxnode, 0);\n+\tret = mbind(mem, page_size, 999, \u0026bind_nodemask, maxnode, 0);\n \tTEST_ASSERT(ret == -1 \u0026\u0026 errno == EINVAL,\n \t\t \"mbind with invalid policy should fail with EINVAL\");\n \n@@ -121,17 +141,19 @@ static void test_mbind(int fd, size_t total_size)\n \n static void test_numa_allocation(int fd, size_t total_size)\n {\n-\tunsigned long node0_mask = 1; /* Node 0 */\n-\tunsigned long node1_mask = 2; /* Node 1 */\n-\tunsigned long maxnode = 8;\n+\tunsigned long bind_nodemasks[2];\n+\tunsigned long maxnode = BITS_PER_TYPE(bind_nodemasks[0]) + 1;\n \tvoid *pages[4];\n+\tint nids[2];\n \tint status[4];\n \tchar *mem;\n \tint i;\n \n-\tif (!is_multi_numa_node_system())\n+\tif (!get_numa_node_ids(nids, ARRAY_SIZE(nids)))\n \t\treturn;\n \n+\tbind_nodemasks[0] = 1UL \u003c\u003c nids[0];\n+\tbind_nodemasks[1] = 1UL \u003c\u003c nids[1];\n \tmem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);\n \n \tfor (i = 0; i \u003c 4; i++)\n@@ -139,34 +161,42 @@ static void test_numa_allocation(int fd, size_t total_size)\n \n \t/* Set NUMA policy after allocation */\n \tmemset(mem, 0xaa, page_size);\n-\tkvm_mbind(pages[0], page_size, MPOL_BIND, \u0026node0_mask, maxnode, 0);\n+\tkvm_mbind(pages[0], page_size, MPOL_BIND, \u0026bind_nodemasks[0], maxnode, 0);\n \tkvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, page_size);\n \n \t/* Set NUMA policy before allocation */\n-\tkvm_mbind(pages[0], page_size * 2, MPOL_BIND, \u0026node1_mask, maxnode, 0);\n-\tkvm_mbind(pages[2], page_size * 2, MPOL_BIND, \u0026node0_mask, maxnode, 0);\n+\tkvm_mbind(pages[0], page_size * 2, MPOL_BIND, \u0026bind_nodemasks[1], maxnode, 0);\n+\tkvm_mbind(pages[2], page_size * 2, MPOL_BIND, \u0026bind_nodemasks[0], maxnode, 0);\n \tmemset(mem, 0xaa, total_size);\n \n \t/* Validate if pages are allocated on specified NUMA nodes */\n \tkvm_move_pages(0, 4, pages, NULL, status, 0);\n-\tTEST_ASSERT(status[0] == 1, \"Expected page 0 on node 1, got it on node %d\", status[0]);\n-\tTEST_ASSERT(status[1] == 1, \"Expected page 1 on node 1, got it on node %d\", status[1]);\n-\tTEST_ASSERT(status[2] == 0, \"Expected page 2 on node 0, got it on node %d\", status[2]);\n-\tTEST_ASSERT(status[3] == 0, \"Expected page 3 on node 0, got it on node %d\", status[3]);\n+\tTEST_ASSERT(status[0] == nids[1],\n+\t\t \"Expected page 0 on node %d, got it on node %d\", nids[1], status[0]);\n+\tTEST_ASSERT(status[1] == nids[1],\n+\t\t \"Expected page 1 on node %d, got it on node %d\", nids[1], status[1]);\n+\tTEST_ASSERT(status[2] == nids[0],\n+\t\t \"Expected page 2 on node %d, got it on node %d\", nids[0], status[2]);\n+\tTEST_ASSERT(status[3] == nids[0],\n+\t\t \"Expected page 3 on node %d, got it on node %d\", nids[0], status[3]);\n \n \t/* Punch hole for all pages */\n \tkvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, total_size);\n \n \t/* Change NUMA policy nodes and reallocate */\n-\tkvm_mbind(pages[0], page_size * 2, MPOL_BIND, \u0026node0_mask, maxnode, 0);\n-\tkvm_mbind(pages[2], page_size * 2, MPOL_BIND, \u0026node1_mask, maxnode, 0);\n+\tkvm_mbind(pages[0], page_size * 2, MPOL_BIND, \u0026bind_nodemasks[0], maxnode, 0);\n+\tkvm_mbind(pages[2], page_size * 2, MPOL_BIND, \u0026bind_nodemasks[1], maxnode, 0);\n \tmemset(mem, 0xaa, total_size);\n \n \tkvm_move_pages(0, 4, pages, NULL, status, 0);\n-\tTEST_ASSERT(status[0] == 0, \"Expected page 0 on node 0, got it on node %d\", status[0]);\n-\tTEST_ASSERT(status[1] == 0, \"Expected page 1 on node 0, got it on node %d\", status[1]);\n-\tTEST_ASSERT(status[2] == 1, \"Expected page 2 on node 1, got it on node %d\", status[2]);\n-\tTEST_ASSERT(status[3] == 1, \"Expected page 3 on node 1, got it on node %d\", status[3]);\n+\tTEST_ASSERT(status[0] == nids[0],\n+\t\t \"Expected page 0 on node %d, got it on node %d\", nids[0], status[0]);\n+\tTEST_ASSERT(status[1] == nids[0],\n+\t\t \"Expected page 1 on node %d, got it on node %d\", nids[0], status[1]);\n+\tTEST_ASSERT(status[2] == nids[1],\n+\t\t \"Expected page 2 on node %d, got it on node %d\", nids[1], status[2]);\n+\tTEST_ASSERT(status[3] == nids[1],\n+\t\t \"Expected page 3 on node %d, got it on node %d\", nids[1], status[3]);\n \n \tkvm_munmap(mem, total_size);\n }\ndiff --git a/tools/testing/selftests/kvm/include/numaif.h b/tools/testing/selftests/kvm/include/numaif.h\nindex 29572a6d789cd..4bbbf314e9d77 100644\n--- a/tools/testing/selftests/kvm/include/numaif.h\n+++ b/tools/testing/selftests/kvm/include/numaif.h\n@@ -4,8 +4,6 @@\n #ifndef SELFTEST_KVM_NUMAIF_H\n #define SELFTEST_KVM_NUMAIF_H\n \n-#include \u003cdirent.h\u003e\n-\n #include \u003clinux/mempolicy.h\u003e\n \n #include \"kvm_syscalls.h\"\n@@ -30,54 +28,16 @@ KVM_SYSCALL_DEFINE(mbind, 6, void *, addr, unsigned long, size, int, mode,\n \t\t const unsigned long *, nodemask, unsigned long, maxnode,\n \t\t unsigned int, flags);\n \n-static inline int get_max_numa_node(void)\n+static inline unsigned long get_numa_mem_nodes(void)\n {\n-\tstruct dirent *de;\n-\tint max_node = 0;\n-\tDIR *d;\n+\tunsigned long nodemask = 0;\n \n-\t/*\n-\t * Assume there's a single node if the kernel doesn't support NUMA,\n-\t * or if no nodes are found.\n-\t */\n-\td = opendir(\"/sys/devices/system/node\");\n-\tif (!d)\n+\t/* Get set of first 64 numa nodes available */\n+\tif (get_mempolicy(NULL, \u0026nodemask, BITS_PER_TYPE(nodemask), NULL,\n+\t\t\t MPOL_F_MEMS_ALLOWED))\n \t\treturn 0;\n \n-\twhile ((de = readdir(d)) != NULL) {\n-\t\tint node_id;\n-\t\tchar *endptr;\n-\n-\t\tif (strncmp(de-\u003ed_name, \"node\", 4) != 0)\n-\t\t\tcontinue;\n-\n-\t\tnode_id = strtol(de-\u003ed_name + 4, \u0026endptr, 10);\n-\t\tif (*endptr != '\\0')\n-\t\t\tcontinue;\n-\n-\t\tif (node_id \u003e max_node)\n-\t\t\tmax_node = node_id;\n-\t}\n-\tclosedir(d);\n-\n-\treturn max_node;\n-}\n-\n-static bool is_numa_available(void)\n-{\n-\t/*\n-\t * Probe for NUMA by doing a dummy get_mempolicy(). If the syscall\n-\t * fails with ENOSYS, then the kernel was built without NUMA support.\n-\t * if the syscall fails with EPERM, then the process/user lacks the\n-\t * necessary capabilities (CAP_SYS_NICE).\n-\t */\n-\treturn !get_mempolicy(NULL, NULL, 0, NULL, 0) ||\n-\t\t(errno != ENOSYS \u0026\u0026 errno != EPERM);\n-}\n-\n-static inline bool is_multi_numa_node_system(void)\n-{\n-\treturn is_numa_available() \u0026\u0026 get_max_numa_node() \u003e= 1;\n+\treturn nodemask;\n }\n \n #endif /* SELFTEST_KVM_NUMAIF_H */\ndiff --git a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c\nindex 39ce9a9369f5b..66dcf36398aaa 100644\n--- a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c\n+++ b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c\n@@ -251,8 +251,8 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,\n \t\t u64 *pipis_rcvd)\n {\n \tlong pages_not_moved;\n-\tunsigned long nodemask = 0;\n-\tunsigned long nodemasks[sizeof(nodemask) * 8];\n+\tunsigned long nodemask;\n+\tunsigned long nodemasks[BITS_PER_TYPE(nodemask)];\n \tint nodes = 0;\n \ttime_t start_time, last_update, now;\n \ttime_t interval_secs = 1;\n@@ -266,19 +266,17 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,\n \tfprintf(stderr, \"Calling migrate_pages every %d microseconds\\n\",\n \t\tdelay_usecs);\n \n-\t/* Get set of first 64 numa nodes available */\n-\tkvm_get_mempolicy(NULL, \u0026nodemask, sizeof(nodemask) * 8,\n-\t\t\t 0, MPOL_F_MEMS_ALLOWED);\n+\tnodemask = get_numa_mem_nodes();\n \n \tfprintf(stderr, \"Numa nodes found amongst first %lu possible nodes \"\n \t\t\"(each 1-bit indicates node is present): %#lx\\n\",\n-\t\tsizeof(nodemask) * 8, nodemask);\n+\t\tBITS_PER_TYPE(nodemask), nodemask);\n \n \t/* Init array of masks containing a single-bit in each, one for each\n \t * available node. migrate_pages called below requires specifying nodes\n \t * as bit masks.\n \t */\n-\tfor (i = 0, bit = 1; i \u003c sizeof(nodemask) * 8; i++, bit \u003c\u003c= 1) {\n+\tfor (i = 0, bit = 1; i \u003c BITS_PER_TYPE(nodemask); i++, bit \u003c\u003c= 1) {\n \t\tif (nodemask \u0026 bit) {\n \t\t\tnodemasks[nodes] = nodemask \u0026 bit;\n \t\t\tnodes++;\n@@ -310,7 +308,7 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,\n \t\t * KVM_CREATE_VCPU ioctl. If that assumption ever changes this\n \t\t * test may break or give a false positive signal.\n \t\t */\n-\t\tpages_not_moved = migrate_pages(0, sizeof(nodemasks[from]),\n+\t\tpages_not_moved = migrate_pages(0, BITS_PER_TYPE(nodemasks[from]) + 1,\n \t\t\t\t\t\t\u0026nodemasks[from],\n \t\t\t\t\t\t\u0026nodemasks[to]);\n \t\tif (pages_not_moved \u003c 0)\ndiff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c\nindex f0e5da4908660..f848120af84be 100644\n--- a/virt/kvm/guest_memfd.c\n+++ b/virt/kvm/guest_memfd.c\n@@ -721,6 +721,8 @@ static void __kvm_gmem_unbind(struct kvm_memory_slot *slot, struct gmem_file *f)\n \n void kvm_gmem_unbind(struct kvm_memory_slot *slot)\n {\n+\tstruct file *gmem_file;\n+\n \t/*\n \t * Nothing to do if the underlying file was _already_ closed, as\n \t * kvm_gmem_release() invalidates and nullifies all bindings.\n@@ -733,21 +735,24 @@ void kvm_gmem_unbind(struct kvm_memory_slot *slot)\n \t/*\n \t * However, if the file is _being_ closed, then the bindings need to be\n \t * removed as kvm_gmem_release() might not run until after the memslot\n-\t * is freed. Note, modifying the bindings is safe even though the file\n-\t * is dying as kvm_gmem_release() nullifies slot-\u003egmem.file under\n+\t * is freed. Note, dereferencing the dying file is safe as\n+\t * kvm_gmem_release() nullifies slot-\u003egmem.file under\n \t * slots_lock, and only puts its reference to KVM after destroying all\n \t * bindings. I.e. reaching this point means kvm_gmem_release() hasn't\n \t * yet destroyed the bindings or freed the gmem_file, and can't do so\n \t * until the caller drops slots_lock.\n \t */\n-\tif (!file) {\n-\t\t__kvm_gmem_unbind(slot, slot-\u003egmem.file-\u003eprivate_data);\n-\t\treturn;\n-\t}\n+\tgmem_file = file ?: slot-\u003egmem.file;\n \n-\tfilemap_invalidate_lock(file-\u003ef_mapping);\n-\t__kvm_gmem_unbind(slot, file-\u003eprivate_data);\n-\tfilemap_invalidate_unlock(file-\u003ef_mapping);\n+\t/*\n+\t * Take the invalidate lock even for a dying file. Otherwise,\n+\t * kvm_gmem_invalidate_start() can find the binding and increment\n+\t * mmu_invalidate_in_progress while kvm_gmem_invalidate_end() misses\n+\t * the removed binding and skips decrement.\n+\t */\n+\tfilemap_invalidate_lock(gmem_file-\u003ef_mapping);\n+\t__kvm_gmem_unbind(slot, gmem_file-\u003eprivate_data);\n+\tfilemap_invalidate_unlock(gmem_file-\u003ef_mapping);\n }\n \n /* Returns a locked folio on success. */\n"
} |
| 2/1 | 2026/08/23 13:43 | agent | patch-evaluator |
8mModel:best-expensive Args: null Results: {
"EnableConfigs": [
"KVM"
],
"FocusSymbols": [
"kvm_gmem_unbind"
],
"Reasoning": "The patch fixes a race condition in `kvm_gmem_unbind` when a guest_memfd file is being closed by ensuring the invalidate lock is taken even for dying files. This is a functional change in core KVM logic that is reachable from userspace and should be fuzzed.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 132ccef91049e6df722ac0c3a9228aaa3de1509a
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Aug 23 13:43:39 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
index 2233d871a38f4..aee80dda62295 100644
--- a/tools/testing/selftests/kvm/guest_memfd_test.c
+++ b/tools/testing/selftests/kvm/guest_memfd_test.c
@@ -76,33 +76,53 @@ static void test_mmap_supported(int fd, size_t total_size)
kvm_munmap(mem, total_size);
}
+/*
+ * Fill @nids with the first @nr_nids nodes in the allowed mask.
+ * Return false if the mask contains fewer than @nr_nids nodes.
+ */
+static bool get_numa_node_ids(int *nids, int nr_nids)
+{
+ unsigned long nodemask = get_numa_mem_nodes();
+ unsigned long nid;
+ int nr_found = 0;
+
+ for_each_set_bit(nid, &nodemask, BITS_PER_TYPE(nodemask)) {
+ nids[nr_found++] = nid;
+ if (nr_found == nr_nids)
+ return true;
+ }
+
+ return false;
+}
+
static void test_mbind(int fd, size_t total_size)
{
- const unsigned long nodemask_0 = 1; /* nid: 0 */
- unsigned long nodemask = 0;
- unsigned long maxnode = BITS_PER_TYPE(nodemask);
+ unsigned long nodemask, bind_nodemask;
+ unsigned long maxnode = BITS_PER_TYPE(nodemask) + 1;
int policy;
char *mem;
+ int nid;
int ret;
- if (!is_multi_numa_node_system())
+ if (!get_numa_node_ids(&nid, 1))
return;
+ bind_nodemask = 1UL << nid;
mem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);
/* Test MPOL_INTERLEAVE policy */
- kvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, &nodemask_0, maxnode, 0);
+ kvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, &bind_nodemask, maxnode, 0);
kvm_get_mempolicy(&policy, &nodemask, maxnode, mem, MPOL_F_ADDR);
- TEST_ASSERT(policy == MPOL_INTERLEAVE && nodemask == nodemask_0,
+ TEST_ASSERT(policy == MPOL_INTERLEAVE && nodemask == bind_nodemask,
"Wanted MPOL_INTERLEAVE (%u) and nodemask 0x%lx, got %u and 0x%lx",
- MPOL_INTERLEAVE, nodemask_0, policy, nodemask);
+ MPOL_INTERLEAVE, bind_nodemask, policy, nodemask);
/* Test basic MPOL_BIND policy */
- kvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, &nodemask_0, maxnode, 0);
+ kvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, &bind_nodemask, maxnode, 0);
kvm_get_mempolicy(&policy, &nodemask, maxnode, mem + page_size * 2, MPOL_F_ADDR);
- TEST_ASSERT(policy == MPOL_BIND && nodemask == nodemask_0,
+ TEST_ASSERT(policy == MPOL_BIND && nodemask == bind_nodemask,
"Wanted MPOL_BIND (%u) and nodemask 0x%lx, got %u and 0x%lx",
- MPOL_BIND, nodemask_0, policy, nodemask);
+ MPOL_BIND, bind_nodemask, policy, nodemask);
/* Test MPOL_DEFAULT policy */
kvm_mbind(mem, total_size, MPOL_DEFAULT, NULL, 0, 0);
@@ -112,7 +132,7 @@ static void test_mbind(int fd, size_t total_size)
MPOL_DEFAULT, policy, nodemask);
/* Test with invalid policy */
- ret = mbind(mem, page_size, 999, &nodemask_0, maxnode, 0);
+ ret = mbind(mem, page_size, 999, &bind_nodemask, maxnode, 0);
TEST_ASSERT(ret == -1 && errno == EINVAL,
"mbind with invalid policy should fail with EINVAL");
@@ -121,17 +141,19 @@ static void test_mbind(int fd, size_t total_size)
static void test_numa_allocation(int fd, size_t total_size)
{
- unsigned long node0_mask = 1; /* Node 0 */
- unsigned long node1_mask = 2; /* Node 1 */
- unsigned long maxnode = 8;
+ unsigned long bind_nodemasks[2];
+ unsigned long maxnode = BITS_PER_TYPE(bind_nodemasks[0]) + 1;
void *pages[4];
+ int nids[2];
int status[4];
char *mem;
int i;
- if (!is_multi_numa_node_system())
+ if (!get_numa_node_ids(nids, ARRAY_SIZE(nids)))
return;
+ bind_nodemasks[0] = 1UL << nids[0];
+ bind_nodemasks[1] = 1UL << nids[1];
mem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);
for (i = 0; i < 4; i++)
@@ -139,34 +161,42 @@ static void test_numa_allocation(int fd, size_t total_size)
/* Set NUMA policy after allocation */
memset(mem, 0xaa, page_size);
- kvm_mbind(pages[0], page_size, MPOL_BIND, &node0_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
kvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, page_size);
/* Set NUMA policy before allocation */
- kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &node1_mask, maxnode, 0);
- kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &node0_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &bind_nodemasks[1], maxnode, 0);
+ kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
memset(mem, 0xaa, total_size);
/* Validate if pages are allocated on specified NUMA nodes */
kvm_move_pages(0, 4, pages, NULL, status, 0);
- TEST_ASSERT(status[0] == 1, "Expected page 0 on node 1, got it on node %d", status[0]);
- TEST_ASSERT(status[1] == 1, "Expected page 1 on node 1, got it on node %d", status[1]);
- TEST_ASSERT(status[2] == 0, "Expected page 2 on node 0, got it on node %d", status[2]);
- TEST_ASSERT(status[3] == 0, "Expected page 3 on node 0, got it on node %d", status[3]);
+ TEST_ASSERT(status[0] == nids[1],
+ "Expected page 0 on node %d, got it on node %d", nids[1], status[0]);
+ TEST_ASSERT(status[1] == nids[1],
+ "Expected page 1 on node %d, got it on node %d", nids[1], status[1]);
+ TEST_ASSERT(status[2] == nids[0],
+ "Expected page 2 on node %d, got it on node %d", nids[0], status[2]);
+ TEST_ASSERT(status[3] == nids[0],
+ "Expected page 3 on node %d, got it on node %d", nids[0], status[3]);
/* Punch hole for all pages */
kvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, total_size);
/* Change NUMA policy nodes and reallocate */
- kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &node0_mask, maxnode, 0);
- kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &node1_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
+ kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &bind_nodemasks[1], maxnode, 0);
memset(mem, 0xaa, total_size);
kvm_move_pages(0, 4, pages, NULL, status, 0);
- TEST_ASSERT(status[0] == 0, "Expected page 0 on node 0, got it on node %d", status[0]);
- TEST_ASSERT(status[1] == 0, "Expected page 1 on node 0, got it on node %d", status[1]);
- TEST_ASSERT(status[2] == 1, "Expected page 2 on node 1, got it on node %d", status[2]);
- TEST_ASSERT(status[3] == 1, "Expected page 3 on node 1, got it on node %d", status[3]);
+ TEST_ASSERT(status[0] == nids[0],
+ "Expected page 0 on node %d, got it on node %d", nids[0], status[0]);
+ TEST_ASSERT(status[1] == nids[0],
+ "Expected page 1 on node %d, got it on node %d", nids[0], status[1]);
+ TEST_ASSERT(status[2] == nids[1],
+ "Expected page 2 on node %d, got it on node %d", nids[1], status[2]);
+ TEST_ASSERT(status[3] == nids[1],
+ "Expected page 3 on node %d, got it on node %d", nids[1], status[3]);
kvm_munmap(mem, total_size);
}
diff --git a/tools/testing/selftests/kvm/include/numaif.h b/tools/testing/selftests/kvm/include/numaif.h
index 29572a6d789cd..4bbbf314e9d77 100644
--- a/tools/testing/selftests/kvm/include/numaif.h
+++ b/tools/testing/selftests/kvm/include/numaif.h
@@ -4,8 +4,6 @@
#ifndef SELFTEST_KVM_NUMAIF_H
#define SELFTEST_KVM_NUMAIF_H
-#include <dirent.h>
-
#include <linux/mempolicy.h>
#include "kvm_syscalls.h"
@@ -30,54 +28,16 @@ KVM_SYSCALL_DEFINE(mbind, 6, void *, addr, unsigned long, size, int, mode,
const unsigned long *, nodemask, unsigned long, maxnode,
unsigned int, flags);
-static inline int get_max_numa_node(void)
+static inline unsigned long get_numa_mem_nodes(void)
{
- struct dirent *de;
- int max_node = 0;
- DIR *d;
+ unsigned long nodemask = 0;
- /*
- * Assume there's a single node if the kernel doesn't support NUMA,
- * or if no nodes are found.
- */
- d = opendir("/sys/devices/system/node");
- if (!d)
+ /* Get set of first 64 numa nodes available */
+ if (get_mempolicy(NULL, &nodemask, BITS_PER_TYPE(nodemask), NULL,
+ MPOL_F_MEMS_ALLOWED))
return 0;
- while ((de = readdir(d)) != NULL) {
- int node_id;
- char *endptr;
-
- if (strncmp(de->d_name, "node", 4) != 0)
- continue;
-
- node_id = strtol(de->d_name + 4, &endptr, 10);
- if (*endptr != '\0')
- continue;
-
- if (node_id > max_node)
- max_node = node_id;
- }
- closedir(d);
-
- return max_node;
-}
-
-static bool is_numa_available(void)
-{
- /*
- * Probe for NUMA by doing a dummy get_mempolicy(). If the syscall
- * fails with ENOSYS, then the kernel was built without NUMA support.
- * if the syscall fails with EPERM, then the process/user lacks the
- * necessary capabilities (CAP_SYS_NICE).
- */
- return !get_mempolicy(NULL, NULL, 0, NULL, 0) ||
- (errno != ENOSYS && errno != EPERM);
-}
-
-static inline bool is_multi_numa_node_system(void)
-{
- return is_numa_available() && get_max_numa_node() >= 1;
+ return nodemask;
}
#endif /* SELFTEST_KVM_NUMAIF_H */
diff --git a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
index 39ce9a9369f5b..66dcf36398aaa 100644
--- a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
+++ b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
@@ -251,8 +251,8 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
u64 *pipis_rcvd)
{
long pages_not_moved;
- unsigned long nodemask = 0;
- unsigned long nodemasks[sizeof(nodemask) * 8];
+ unsigned long nodemask;
+ unsigned long nodemasks[BITS_PER_TYPE(nodemask)];
int nodes = 0;
time_t start_time, last_update, now;
time_t interval_secs = 1;
@@ -266,19 +266,17 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
fprintf(stderr, "Calling migrate_pages every %d microseconds\n",
delay_usecs);
- /* Get set of first 64 numa nodes available */
- kvm_get_mempolicy(NULL, &nodemask, sizeof(nodemask) * 8,
- 0, MPOL_F_MEMS_ALLOWED);
+ nodemask = get_numa_mem_nodes();
fprintf(stderr, "Numa nodes found amongst first %lu possible nodes "
"(each 1-bit indicates node is present): %#lx\n",
- sizeof(nodemask) * 8, nodemask);
+ BITS_PER_TYPE(nodemask), nodemask);
/* Init array of masks containing a single-bit in each, one for each
* available node. migrate_pages called below requires specifying nodes
* as bit masks.
*/
- for (i = 0, bit = 1; i < sizeof(nodemask) * 8; i++, bit <<= 1) {
+ for (i = 0, bit = 1; i < BITS_PER_TYPE(nodemask); i++, bit <<= 1) {
if (nodemask & bit) {
nodemasks[nodes] = nodemask & bit;
nodes++;
@@ -310,7 +308,7 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
* KVM_CREATE_VCPU ioctl. If that assumption ever changes this
* test may break or give a false positive signal.
*/
- pages_not_moved = migrate_pages(0, sizeof(nodemasks[from]),
+ pages_not_moved = migrate_pages(0, BITS_PER_TYPE(nodemasks[from]) + 1,
&nodemasks[from],
&nodemasks[to]);
if (pages_not_moved < 0)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index f0e5da4908660..f848120af84be 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -721,6 +721,8 @@ static void __kvm_gmem_unbind(struct kvm_memory_slot *slot, struct gmem_file *f)
void kvm_gmem_unbind(struct kvm_memory_slot *slot)
{
+ struct file *gmem_file;
+
/*
* Nothing to do if the underlying file was _already_ closed, as
* kvm_gmem_release() invalidates and nullifies all bindings.
@@ -733,21 +735,24 @@ void kvm_gmem_unbind(struct kvm_memory_slot *slot)
/*
* However, if the file is _being_ closed, then the bindings need to be
* removed as kvm_gmem_release() might not run until after the memslot
- * is freed. Note, modifying the bindings is safe even though the file
- * is dying as kvm_gmem_release() nullifies slot->gmem.file under
+ * is freed. Note, dereferencing the dying file is safe as
+ * kvm_gmem_release() nullifies slot->gmem.file under
* slots_lock, and only puts its reference to KVM after destroying all
* bindings. I.e. reaching this point means kvm_gmem_release() hasn't
* yet destroyed the bindings or freed the gmem_file, and can't do so
* until the caller drops slots_lock.
*/
- if (!file) {
- __kvm_gmem_unbind(slot, slot->gmem.file->private_data);
- return;
- }
+ gmem_file = file ?: slot->gmem.file;
- filemap_invalidate_lock(file->f_mapping);
- __kvm_gmem_unbind(slot, file->private_data);
- filemap_invalidate_unlock(file->f_mapping);
+ /*
+ * Take the invalidate lock even for a dying file. Otherwise,
+ * kvm_gmem_invalidate_start() can find the binding and increment
+ * mmu_invalidate_in_progress while kvm_gmem_invalidate_end() misses
+ * the removed binding and skips decrement.
+ */
+ filemap_invalidate_lock(gmem_file->f_mapping);
+ __kvm_gmem_unbind(slot, gmem_file->private_data);
+ filemap_invalidate_unlock(gmem_file->f_mapping);
}
/* Returns a locked folio on success. */
|
| 3/2 | 2026/08/23 13:43 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7185 output: 21 thoughts: 782 Thoughts: **Analyzing a KVM Guest Memfd Bug Fix** Okay, so I'm looking at a patch here that touches a few files: `guest_memfd_test.c`, `numaif.h`, `xapic_ipi_test.c`, and, most importantly, `guest_memfd.c`. The changes in `guest_memfd.c` are what I'm focusing on. Specifically, it's a bug fix in the `kvm_gmem_unbind` function, which is core KVM functionality related to guest memfd. The gist of it is this: when a guest memfd file is being closed, and the `file` pointer is null (meaning the file is dying) the `filemap_invalidate_lock` wasn't being taken. This is a critical oversight. If that lock isn't held, then the invalidate logic could get into a race condition. Specifically, `kvm_gmem_invalidate_start()` could see an active binding, incrementing a counter, while `kvm_gmem_invalidate_end()` might miss the unbinding, leaving that counter unbalanced. This can lead to significant issues. The patch corrects this by ensuring that the invalidate lock is always taken before unbinding the guest memfd slot, even when the underlying file is being closed. The logic now uses either the existing `file` pointer or uses the slot's `gmem.file` if the `file` pointer is null. This guarantees that `filemap_invalidate_lock` is held. This is a pretty straightforward functional fix, but it's a critical one because this function sits in the heart of how KVM handles guest memfd, and memory management issues can easily lead to much more serious problems. I should probably dive into the callers of `kvm_gmem_unbind` and make sure there are no other subtle dependencies I'm missing. |
| 4/2 | 2026/08/23 13:43 | tool | grepper |
0mArgs:{
"Expression": "kvm_gmem_unbind"
}Results: {
"Output": "virt/kvm/guest_memfd.c=643=int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,\n--\nvirt/kvm/guest_memfd.c-707-\nvirt/kvm/guest_memfd.c:708:static void __kvm_gmem_unbind(struct kvm_memory_slot *slot, struct gmem_file *f)\nvirt/kvm/guest_memfd.c-709-{\n--\nvirt/kvm/guest_memfd.c-721-\nvirt/kvm/guest_memfd.c:722:void kvm_gmem_unbind(struct kvm_memory_slot *slot)\nvirt/kvm/guest_memfd.c-723-{\n--\nvirt/kvm/guest_memfd.c-753-\tfilemap_invalidate_lock(gmem_file-\u003ef_mapping);\nvirt/kvm/guest_memfd.c:754:\t__kvm_gmem_unbind(slot, gmem_file-\u003eprivate_data);\nvirt/kvm/guest_memfd.c-755-\tfilemap_invalidate_unlock(gmem_file-\u003ef_mapping);\n--\nvirt/kvm/kvm_main.c=935=static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *slot)\n--\nvirt/kvm/kvm_main.c-937-\tif (slot-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c:938:\t\tkvm_gmem_unbind(slot);\nvirt/kvm/kvm_main.c-939-\n--\nvirt/kvm/kvm_main.c=1696=static void kvm_commit_memory_region(struct kvm *kvm,\n--\nvirt/kvm/kvm_main.c-1749-\t\tif (WARN_ON_ONCE(old-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD))\nvirt/kvm/kvm_main.c:1750:\t\t\tkvm_gmem_unbind(old);\nvirt/kvm/kvm_main.c-1751-\n--\nvirt/kvm/kvm_main.c=1994=static int kvm_set_memory_region(struct kvm *kvm,\n--\nvirt/kvm/kvm_main.c-2120-\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c:2121:\t\tkvm_gmem_unbind(new);\nvirt/kvm/kvm_main.c-2122-out:\n--\nvirt/kvm/kvm_mm.h=77=int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,\nvirt/kvm/kvm_mm.h-78-\t\t unsigned int fd, uoff_t offset);\nvirt/kvm/kvm_mm.h:79:void kvm_gmem_unbind(struct kvm_memory_slot *slot);\nvirt/kvm/kvm_mm.h-80-#else\n--\nvirt/kvm/kvm_mm.h=86=static inline int kvm_gmem_bind(struct kvm *kvm,\n--\nvirt/kvm/kvm_mm.h-93-\nvirt/kvm/kvm_mm.h:94:static inline void kvm_gmem_unbind(struct kvm_memory_slot *slot)\nvirt/kvm/kvm_mm.h-95-{\n"
} |
| 5/2 | 2026/08/23 13:43 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9327 output: 24 thoughts: 85 Thoughts: **Fuzzing Target Identification** Okay, so I've pinpointed a promising target. The `kvm_gmem_unbind` function in `kvm_main.c` seems to be a key area for fuzzing. The fact that it's called from multiple important functions like `kvm_free_memslot`, `kvm_commit_memory_region`, and `kvm_set_memory_region` suggests it's a critical path with potentially interesting vulnerabilities. It's definitely reachable through standard KVM operations, making it a good candidate for exploring with fuzzing. Now, let's see what config options are required to enable guest_memfd and proceed further. |
| 6/2 | 2026/08/23 13:43 | tool | grepper |
0mArgs:{
"Expression": "KVM_MEM_GUEST_MEMFD"
}Results: {
"Output": "Documentation/virt/kvm/api.rst=6335=allows mapping guest_memfd memory into a guest. All fields shared with\nDocumentation/virt/kvm/api.rst:6336:KVM_SET_USER_MEMORY_REGION identically. Userspace can set KVM_MEM_GUEST_MEMFD\nDocumentation/virt/kvm/api.rst-6337-in flags to have KVM bind the memory region to a given guest_memfd range of\n--\nDocumentation/virt/kvm/api.rst=6341=bounds checks apply (use common sense).\n--\nDocumentation/virt/kvm/api.rst-6356-\nDocumentation/virt/kvm/api.rst:6357:A KVM_MEM_GUEST_MEMFD region _must_ have a valid guest_memfd (private memory) and\nDocumentation/virt/kvm/api.rst-6358-userspace_addr (shared memory). However, \"valid\" for userspace_addr simply\n--\ninclude/linux/kvm_host.h=619=static inline bool kvm_slot_has_gmem(const struct kvm_memory_slot *slot)\ninclude/linux/kvm_host.h-620-{\ninclude/linux/kvm_host.h:621:\treturn slot \u0026\u0026 (slot-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD);\ninclude/linux/kvm_host.h-622-}\n--\ninclude/uapi/linux/kvm.h=39=struct kvm_userspace_memory_region2 {\n--\ninclude/uapi/linux/kvm.h-57-#define KVM_MEM_READONLY\t(1UL \u003c\u003c 1)\ninclude/uapi/linux/kvm.h:58:#define KVM_MEM_GUEST_MEMFD\t(1UL \u003c\u003c 2)\ninclude/uapi/linux/kvm.h-59-\n--\ntools/include/uapi/linux/kvm.h=39=struct kvm_userspace_memory_region2 {\n--\ntools/include/uapi/linux/kvm.h-57-#define KVM_MEM_READONLY\t(1UL \u003c\u003c 1)\ntools/include/uapi/linux/kvm.h:58:#define KVM_MEM_GUEST_MEMFD\t(1UL \u003c\u003c 2)\ntools/include/uapi/linux/kvm.h-59-\n--\ntools/testing/selftests/kvm/guest_memfd_test.c=378=static void test_invalid_binding(struct kvm_vm *vm, int fd, size_t size)\n--\ntools/testing/selftests/kvm/guest_memfd_test.c-381-\ntools/testing/selftests/kvm/guest_memfd_test.c:382:\tr = __vm_set_user_memory_region2(vm, 0, KVM_MEM_GUEST_MEMFD, 0, size, 0,\ntools/testing/selftests/kvm/guest_memfd_test.c-383-\t\t\t\t\t fd, ALIGN_DOWN(INT64_MAX, page_size));\n--\ntools/testing/selftests/kvm/guest_memfd_test.c=535=static void test_guest_memfd_guest(void)\n--\ntools/testing/selftests/kvm/guest_memfd_test.c-570-\t\t\t\t\t GUEST_MEMFD_FLAG_INIT_SHARED);\ntools/testing/selftests/kvm/guest_memfd_test.c:571:\tvm_set_user_memory_region2(vm, slot, KVM_MEM_GUEST_MEMFD, gpa, size, NULL, fd, 0);\ntools/testing/selftests/kvm/guest_memfd_test.c-572-\n--\ntools/testing/selftests/kvm/lib/kvm_util.c=479=struct kvm_vm *__vm_create(struct vm_shape shape, u32 nr_runnable_vcpus,\n--\ntools/testing/selftests/kvm/lib/kvm_util.c-500-\tif (is_guest_memfd_required(shape))\ntools/testing/selftests/kvm/lib/kvm_util.c:501:\t\tflags |= KVM_MEM_GUEST_MEMFD;\ntools/testing/selftests/kvm/lib/kvm_util.c-502-\n--\ntools/testing/selftests/kvm/lib/kvm_util.c=979=void vm_mem_add(struct kvm_vm *vm, enum vm_mem_backing_src_type src_type,\n--\ntools/testing/selftests/kvm/lib/kvm_util.c-1084-\ntools/testing/selftests/kvm/lib/kvm_util.c:1085:\tif (flags \u0026 KVM_MEM_GUEST_MEMFD) {\ntools/testing/selftests/kvm/lib/kvm_util.c-1086-\t\tif (guest_memfd \u003c 0) {\n--\ntools/testing/selftests/kvm/lib/kvm_util.c=1274=void vm_guest_mem_fallocate(struct kvm_vm *vm, u64 base, u64 size,\n--\ntools/testing/selftests/kvm/lib/kvm_util.c-1287-\t\tregion = userspace_mem_region_find(vm, gpa, gpa);\ntools/testing/selftests/kvm/lib/kvm_util.c:1288:\t\tTEST_ASSERT(region \u0026\u0026 region-\u003eregion.flags \u0026 KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/lib/kvm_util.c-1289-\t\t\t \"Private memory region not found for GPA 0x%lx\", gpa);\n--\ntools/testing/selftests/kvm/pre_fault_memory_test.c=65=static void pre_fault_memory(struct kvm_vcpu *vcpu, u64 base_gpa, u64 offset,\n--\ntools/testing/selftests/kvm/pre_fault_memory_test.c-75-\t\t.gpa = base_gpa,\ntools/testing/selftests/kvm/pre_fault_memory_test.c:76:\t\t.flags = private ? KVM_MEM_GUEST_MEMFD : 0,\ntools/testing/selftests/kvm/pre_fault_memory_test.c-77-\t};\n--\ntools/testing/selftests/kvm/pre_fault_memory_test.c=163=static void __test_pre_fault_memory(unsigned long vm_type, bool private)\n--\ntools/testing/selftests/kvm/pre_fault_memory_test.c-182-\tvm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, gpa, TEST_SLOT,\ntools/testing/selftests/kvm/pre_fault_memory_test.c:183:\t\t\t\t TEST_NPAGES, private ? KVM_MEM_GUEST_MEMFD : 0);\ntools/testing/selftests/kvm/pre_fault_memory_test.c-184-\tvirt_map(vm, gva, gpa, TEST_NPAGES);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c=346=static void test_invalid_memory_region_flags(void)\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-348-\tu32 supported_flags = KVM_MEM_LOG_DIRTY_PAGES;\ntools/testing/selftests/kvm/set_memory_region_test.c:349:\tconst u32 v2_only_flags = KVM_MEM_GUEST_MEMFD;\ntools/testing/selftests/kvm/set_memory_region_test.c-350-\tstruct kvm_vm *vm;\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-364-\tif (kvm_check_cap(KVM_CAP_MEMORY_ATTRIBUTES) \u0026 KVM_MEMORY_ATTRIBUTE_PRIVATE)\ntools/testing/selftests/kvm/set_memory_region_test.c:365:\t\tsupported_flags |= KVM_MEM_GUEST_MEMFD;\ntools/testing/selftests/kvm/set_memory_region_test.c-366-\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-385-\ntools/testing/selftests/kvm/set_memory_region_test.c:386:\tif (supported_flags \u0026 KVM_MEM_GUEST_MEMFD) {\ntools/testing/selftests/kvm/set_memory_region_test.c-387-\t\tint guest_memfd = vm_create_guest_memfd(vm, MEM_REGION_SIZE, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-389-\t\tr = __vm_set_user_memory_region2(vm, 0,\ntools/testing/selftests/kvm/set_memory_region_test.c:390:\t\t\t\t\t\t KVM_MEM_LOG_DIRTY_PAGES | KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-391-\t\t\t\t\t\t 0, MEM_REGION_SIZE, NULL, guest_memfd, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-395-\t\tr = __vm_set_user_memory_region2(vm, 0,\ntools/testing/selftests/kvm/set_memory_region_test.c:396:\t\t\t\t\t\t KVM_MEM_READONLY | KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-397-\t\t\t\t\t\t 0, MEM_REGION_SIZE, NULL, guest_memfd, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c=458=static void test_invalid_guest_memfd(struct kvm_vm *vm, int memfd,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-460-{\ntools/testing/selftests/kvm/set_memory_region_test.c:461:\tint r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-462-\t\t\t\t\t MEM_REGION_GPA, MEM_REGION_SIZE,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c=467=static void test_add_private_memory_region(void)\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-471-\ntools/testing/selftests/kvm/set_memory_region_test.c:472:\tpr_info(\"Testing ADD of KVM_MEM_GUEST_MEMFD memory regions\\n\");\ntools/testing/selftests/kvm/set_memory_region_test.c-473-\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-486-\ntools/testing/selftests/kvm/set_memory_region_test.c:487:\tvm_set_user_memory_region2(vm2, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-488-\t\t\t\t MEM_REGION_GPA, MEM_REGION_SIZE, 0, memfd, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-495-\ntools/testing/selftests/kvm/set_memory_region_test.c:496:\tvm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-497-\t\t\t\t MEM_REGION_GPA, MEM_REGION_SIZE, 0, memfd, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c=503=static void test_add_overlapping_private_memory_regions(void)\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-508-\ntools/testing/selftests/kvm/set_memory_region_test.c:509:\tpr_info(\"Testing ADD of overlapping KVM_MEM_GUEST_MEMFD memory regions\\n\");\ntools/testing/selftests/kvm/set_memory_region_test.c-510-\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-514-\ntools/testing/selftests/kvm/set_memory_region_test.c:515:\tvm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-516-\t\t\t\t MEM_REGION_GPA, MEM_REGION_SIZE * 2, 0, memfd, 0);\ntools/testing/selftests/kvm/set_memory_region_test.c-517-\ntools/testing/selftests/kvm/set_memory_region_test.c:518:\tvm_set_user_memory_region2(vm, MEM_REGION_SLOT + 1, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-519-\t\t\t\t MEM_REGION_GPA * 2, MEM_REGION_SIZE * 2,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-525-\t */\ntools/testing/selftests/kvm/set_memory_region_test.c:526:\tvm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-527-\t\t\t\t MEM_REGION_GPA, 0, NULL, -1, 0);\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-532-\t */\ntools/testing/selftests/kvm/set_memory_region_test.c:533:\tr = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-534-\t\t\t\t\t MEM_REGION_GPA,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-540-\t/* And now the back half of the other slot's guest_memfd binding. */\ntools/testing/selftests/kvm/set_memory_region_test.c:541:\tr = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-542-\t\t\t\t\t MEM_REGION_GPA,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-552-\t */\ntools/testing/selftests/kvm/set_memory_region_test.c:553:\tr = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-554-\t\t\t\t\t MEM_REGION_GPA * 2 - MEM_REGION_SIZE,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-560-\t/* And now the back half of the other slot. */\ntools/testing/selftests/kvm/set_memory_region_test.c:561:\tr = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,\ntools/testing/selftests/kvm/set_memory_region_test.c-562-\t\t\t\t\t MEM_REGION_GPA * 2 + MEM_REGION_SIZE,\n--\ntools/testing/selftests/kvm/set_memory_region_test.c=623=int main(int argc, char *argv[])\n--\ntools/testing/selftests/kvm/set_memory_region_test.c-648-\t} else {\ntools/testing/selftests/kvm/set_memory_region_test.c:649:\t\tpr_info(\"Skipping tests for KVM_MEM_GUEST_MEMFD memory regions\\n\");\ntools/testing/selftests/kvm/set_memory_region_test.c-650-\t}\n--\ntools/testing/selftests/kvm/x86/private_mem_conversions_test.c=369=static void test_mem_conversions(enum vm_mem_backing_src_type src_type, u32 nr_vcpus,\n--\ntools/testing/selftests/kvm/x86/private_mem_conversions_test.c-401-\t\t\t BASE_DATA_SLOT + i, slot_size / vm-\u003epage_size,\ntools/testing/selftests/kvm/x86/private_mem_conversions_test.c:402:\t\t\t KVM_MEM_GUEST_MEMFD, memfd, slot_size * i);\ntools/testing/selftests/kvm/x86/private_mem_conversions_test.c-403-\n--\ntools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c=47=static void test_private_access_memslot_deleted(void)\n--\ntools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c-60-\t\t\t\t EXITS_TEST_NPAGES,\ntools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c:61:\t\t\t\t KVM_MEM_GUEST_MEMFD);\ntools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c-62-\n--\nvirt/kvm/guest_memfd.c=643=int kvm_gmem_bind(struct kvm *kvm, struct kvm_memory_slot *slot,\n--\nvirt/kvm/guest_memfd.c-684-\t/*\nvirt/kvm/guest_memfd.c:685:\t * memslots of flag KVM_MEM_GUEST_MEMFD are immutable to change, so\nvirt/kvm/guest_memfd.c-686-\t * kvm_gmem_bind() must occur on a new memslot. Because the memslot\n--\nvirt/kvm/kvm_main.c=935=static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *slot)\nvirt/kvm/kvm_main.c-936-{\nvirt/kvm/kvm_main.c:937:\tif (slot-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c-938-\t\tkvm_gmem_unbind(slot);\n--\nvirt/kvm/kvm_main.c=1573=static int check_memory_region_flags(struct kvm *kvm,\n--\nvirt/kvm/kvm_main.c-1578-\tif (IS_ENABLED(CONFIG_KVM_GUEST_MEMFD))\nvirt/kvm/kvm_main.c:1579:\t\tvalid_flags |= KVM_MEM_GUEST_MEMFD;\nvirt/kvm/kvm_main.c-1580-\nvirt/kvm/kvm_main.c-1581-\t/* Dirty logging private memory is not currently supported. */\nvirt/kvm/kvm_main.c:1582:\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c-1583-\t\tvalid_flags \u0026= ~KVM_MEM_LOG_DIRTY_PAGES;\n--\nvirt/kvm/kvm_main.c-1590-\tif (kvm_arch_has_readonly_mem(kvm) \u0026\u0026\nvirt/kvm/kvm_main.c:1591:\t !(mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD))\nvirt/kvm/kvm_main.c-1592-\t\tvalid_flags |= KVM_MEM_READONLY;\n--\nvirt/kvm/kvm_main.c=1696=static void kvm_commit_memory_region(struct kvm *kvm,\n--\nvirt/kvm/kvm_main.c-1732-\t\t */\nvirt/kvm/kvm_main.c:1733:\t\tWARN_ON_ONCE(old-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD);\nvirt/kvm/kvm_main.c-1734-\t\tfallthrough;\n--\nvirt/kvm/kvm_main.c-1748-\t\t */\nvirt/kvm/kvm_main.c:1749:\t\tif (WARN_ON_ONCE(old-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD))\nvirt/kvm/kvm_main.c-1750-\t\t\tkvm_gmem_unbind(old);\n--\nvirt/kvm/kvm_main.c=1994=static int kvm_set_memory_region(struct kvm *kvm,\n--\nvirt/kvm/kvm_main.c-2025-\t\treturn -EINVAL;\nvirt/kvm/kvm_main.c:2026:\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD \u0026\u0026\nvirt/kvm/kvm_main.c-2027-\t (mem-\u003eguest_memfd_offset \u0026 (PAGE_SIZE - 1) ||\n--\nvirt/kvm/kvm_main.c-2076-\t\t/* Private memslots are immutable, they can only be deleted. */\nvirt/kvm/kvm_main.c:2077:\t\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c-2078-\t\t\treturn -EINVAL;\n--\nvirt/kvm/kvm_main.c-2080-\t\t (npages != old-\u003enpages) ||\nvirt/kvm/kvm_main.c:2081:\t\t ((mem-\u003eflags ^ old-\u003eflags) \u0026 (KVM_MEM_READONLY | KVM_MEM_GUEST_MEMFD)))\nvirt/kvm/kvm_main.c-2082-\t\t\treturn -EINVAL;\n--\nvirt/kvm/kvm_main.c-2106-\tnew-\u003euserspace_addr = mem-\u003euserspace_addr;\nvirt/kvm/kvm_main.c:2107:\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD) {\nvirt/kvm/kvm_main.c-2108-\t\tr = kvm_gmem_bind(kvm, new, mem-\u003eguest_memfd, mem-\u003eguest_memfd_offset);\n--\nvirt/kvm/kvm_main.c-2119-out_unbind:\nvirt/kvm/kvm_main.c:2120:\tif (mem-\u003eflags \u0026 KVM_MEM_GUEST_MEMFD)\nvirt/kvm/kvm_main.c-2121-\t\tkvm_gmem_unbind(new);\n"
} |
| 7/2 | 2026/08/23 13:43 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 15739 output: 23 thoughts: 38 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: **Investigating the KVM Guest Memory File Descriptor Configuration Option** Alright, the objective here is to figure out the dependencies and context for `CONFIG_KVM_GUEST_MEMFD`. Let's assume this is a KVM (Kernel-based Virtual Machine) related configuration option. My immediate reflex is to check the relevant Kconfig files. The most likely candidates for something like this would be in the `virt/kvm/` directory of the kernel source, or potentially a similarly named directory if there's an abstraction layer. I'll need to look inside `Kconfig` files – they're the usual places where this kind of thing is defined, and dependencies are clearly listed. If it isn't `Kconfig`, I need to look for any `.config` file within the directories associated with the subsystem. I would be looking for any clues about what features this depends on, what it enables, and potentially which architectures or processors this is relevant to. Time to dig in! |
| 8/2 | 2026/08/23 13:44 | tool | grepper |
0mArgs:{
"Expression": "config KVM_GUEST_MEMFD"
}Results: {
"Output": "virt/kvm/Kconfig=103=config KVM_GENERIC_MEMORY_ATTRIBUTES\n--\nvirt/kvm/Kconfig-105-\nvirt/kvm/Kconfig:106:config KVM_GUEST_MEMFD\nvirt/kvm/Kconfig-107- select XARRAY_MULTI\n"
} |
| 9/2 | 2026/08/23 13:44 | llm | patch-evaluator |
6mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16119 output: 35 thoughts: 20 Thoughts: Here's my summary, as though I'm reading and processing the provided text: **KVM Configuration Deep Dive** Okay, let's dive into the `virt/kvm/Kconfig` file, specifically around line 106. I need to understand how the KVM configuration options are structured and what's being enabled or disabled at that point in the code. I'm looking for the core set of options; it's likely they are the basics for the module to build. |
| 10/2 | 2026/08/23 13:50 | tool | read-file |
0mArgs:{
"File": "virt/kvm/Kconfig",
"FirstLine": 100,
"LineCount": 20
}Results: {
"Contents": " 100:\tconfig KVM_MMU_LOCKLESS_AGING\n 101:\t bool\n 102:\t\n 103:\tconfig KVM_GENERIC_MEMORY_ATTRIBUTES\n 104:\t bool\n 105:\t\n 106:\tconfig KVM_GUEST_MEMFD\n 107:\t select XARRAY_MULTI\n 108:\t bool\n 109:\t\n 110:\tconfig HAVE_KVM_ARCH_GMEM_PREPARE\n 111:\t bool\n 112:\t depends on KVM_GUEST_MEMFD\n 113:\t\n 114:\tconfig HAVE_KVM_ARCH_GMEM_INVALIDATE\n 115:\t bool\n 116:\t depends on KVM_GUEST_MEMFD\n 117:\t\n 118:\tconfig HAVE_KVM_ARCH_GMEM_POPULATE\n 119:\t bool\n"
} |
| 11/2 | 2026/08/23 13:50 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16546 output: 23 thoughts: 35 Thoughts: **Investigating KVM_GUEST_MEMFD** Okay, so I've stumbled upon this `KVM_GUEST_MEMFD` boolean, and it's flagged as hidden. My initial hunch, given its name and hidden status, is that it's likely selected deep within the architecture-specific KVM configuration files. It's not something I'd expect to see exposed directly at a high level. Therefore, my immediate next step is to trace its dependencies. I need to figure out *exactly* what's pulling this in. Understanding the "select" relationships will give me a critical understanding of the underlying rationale and which specific hardware or architectural nuances necessitate its inclusion. Time to dive into those configs. |
| 12/2 | 2026/08/23 13:51 | tool | grepper |
0mArgs:{
"Expression": "select KVM_GUEST_MEMFD"
}Results: {
"Output": "arch/arm64/kvm/Kconfig=20=menuconfig KVM\n--\narch/arm64/kvm/Kconfig-38-\tselect GUEST_PERF_EVENTS if PERF_EVENTS\narch/arm64/kvm/Kconfig:39:\tselect KVM_GUEST_MEMFD\narch/arm64/kvm/Kconfig-40-\thelp\n--\narch/x86/kvm/Kconfig=20=config KVM_X86\n--\narch/x86/kvm/Kconfig-49-\tselect KVM_WERROR if WERROR\narch/x86/kvm/Kconfig:50:\tselect KVM_GUEST_MEMFD if X86_64\narch/x86/kvm/Kconfig-51-\n"
} |
| 13/2 | 2026/08/23 13:51 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16965 output: 25 thoughts: 261 Thoughts: **My Assessment of the KVM Changes** Okay, so I've been looking at this KVM change, and here's what I've got so far. The key enabling config seems to be `KVM`, and it's being used across both arm64 and x86_64 architectures – a good sign of wider applicability, or at least intent. The core of the change appears to be centered on the `kvm_gmem_unbind` function, located in `virt/kvm/guest_memfd.c`. I'm going to quickly scan for other affected functions, just to be thorough. Ah, and I see the self-tests have been updated in `tools/testing/selftests/kvm/guest_memfd_test.c` and `tools/testing/selftests/kvm/x86/xapic_ipi_test.c`. Those are purely tests though, not kernel code, so they don't impact my immediate fuzzing focus. Right, so the kernel code modification is really just `kvm_gmem_unbind`. That's a very focused change, which makes it an ideal target for fuzzing. I'll need to zero in on this function. Let's quickly confirm whether `kvm_gmem_unbind` is static or not. Okay, let's see: ```c void kvm_gmem_unbind(struct kvm_memory_slot *slot) ``` No, it's not static. Good. This is probably exported for other modules to access it. Now, I'll need to check if it's exported and visible to other modules. |
| 14/2 | 2026/08/23 13:51 | tool | grepper |
0mError:no matches Args: {
"Expression": "EXPORT_SYMBOL.*kvm_gmem_unbind"
}Results: {
"error": "no matches"
} |
| 15/2 | 2026/08/23 13:51 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 17628 output: 105 thoughts: 841 Thoughts: **Analyzing the Guest Memfd Unbind Patch** Okay, so I'm looking at this patch and, even though `kvm_gmem_unbind` isn't explicitly exported, it's a global function within `virt/kvm/guest_memfd.c` and is called from `virt/kvm/kvm_main.c`. Therefore, it's perfectly valid to use it as a focus symbol for further analysis. Let me take a quick look to see if any other functions in `virt/kvm/guest_memfd.c` were touched. The diff only mentions modifications to `kvm_gmem_unbind`, which confirms the scope. Alright, the core of the fix revolves around a missing `filemap_invalidate_lock` call. Previously, when the `file` pointer was NULL—indicating the file was being closed—the lock wasn't acquired. This omission creates a race condition. The patch addresses this by always taking the lock, even if the file is null. This looks like a race condition fix. Given the nature of the fix, targeting the core KVM functionality surrounding guest memfd, I'm going to set `WorthFuzzing=true`. I will also use `FocusSymbols=["kvm_gmem_unbind"]` to concentrate the fuzzing efforts on this specific function. Finally, the relevant configuration is `EnableConfigs=["KVM"]`. This seems like a reasonable approach to ensure thorough testing of this critical KVM component, especially considering the race condition nature of the bug. |
| 16/2 | 2026/08/23 13:51 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"KVM"
],
"FocusSymbols": [
"kvm_gmem_unbind"
],
"Reasoning": "The patch fixes a race condition in `kvm_gmem_unbind` when a guest_memfd file is being closed by ensuring the invalidate lock is taken even for dying files. This is a functional change in core KVM logic that is reachable from userspace and should be fuzzed.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"KVM"
],
"FocusSymbols": [
"kvm_gmem_unbind"
],
"Reasoning": "The patch fixes a race condition in `kvm_gmem_unbind` when a guest_memfd file is being closed by ensuring the invalidate lock is taken even for dying files. This is a functional change in core KVM logic that is reachable from userspace and should be fuzzed.",
"WorthFuzzing": true
} |
| 17/1 | 2026/08/23 13:51 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 18/2 | 2026/08/23 13:51 | agent | kmsan-evaluator |
0mModel:best-expensive Args: null Results: {
"KMSANReasoning": "The patch modifies KVM guest_memfd selftests and fixes a locking/concurrency bug in `kvm_gmem_unbind` in `virt/kvm/guest_memfd.c`. The bug fix ensures that `filemap_invalidate_lock` is taken even when the file is dying, preventing a mismatch in `mmu_invalidate_in_progress` increments/decrements. This is a logic/concurrency issue, not an uninitialized memory read or info-leak. Therefore, KMSAN is not applicable, and standard KASAN/LOCKDEP testing is sufficient.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit 132ccef91049e6df722ac0c3a9228aaa3de1509a
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Aug 23 13:43:39 2026 +0000
syz-cluster: applied patch under review
diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
index 2233d871a38f4..aee80dda62295 100644
--- a/tools/testing/selftests/kvm/guest_memfd_test.c
+++ b/tools/testing/selftests/kvm/guest_memfd_test.c
@@ -76,33 +76,53 @@ static void test_mmap_supported(int fd, size_t total_size)
kvm_munmap(mem, total_size);
}
+/*
+ * Fill @nids with the first @nr_nids nodes in the allowed mask.
+ * Return false if the mask contains fewer than @nr_nids nodes.
+ */
+static bool get_numa_node_ids(int *nids, int nr_nids)
+{
+ unsigned long nodemask = get_numa_mem_nodes();
+ unsigned long nid;
+ int nr_found = 0;
+
+ for_each_set_bit(nid, &nodemask, BITS_PER_TYPE(nodemask)) {
+ nids[nr_found++] = nid;
+ if (nr_found == nr_nids)
+ return true;
+ }
+
+ return false;
+}
+
static void test_mbind(int fd, size_t total_size)
{
- const unsigned long nodemask_0 = 1; /* nid: 0 */
- unsigned long nodemask = 0;
- unsigned long maxnode = BITS_PER_TYPE(nodemask);
+ unsigned long nodemask, bind_nodemask;
+ unsigned long maxnode = BITS_PER_TYPE(nodemask) + 1;
int policy;
char *mem;
+ int nid;
int ret;
- if (!is_multi_numa_node_system())
+ if (!get_numa_node_ids(&nid, 1))
return;
+ bind_nodemask = 1UL << nid;
mem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);
/* Test MPOL_INTERLEAVE policy */
- kvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, &nodemask_0, maxnode, 0);
+ kvm_mbind(mem, page_size * 2, MPOL_INTERLEAVE, &bind_nodemask, maxnode, 0);
kvm_get_mempolicy(&policy, &nodemask, maxnode, mem, MPOL_F_ADDR);
- TEST_ASSERT(policy == MPOL_INTERLEAVE && nodemask == nodemask_0,
+ TEST_ASSERT(policy == MPOL_INTERLEAVE && nodemask == bind_nodemask,
"Wanted MPOL_INTERLEAVE (%u) and nodemask 0x%lx, got %u and 0x%lx",
- MPOL_INTERLEAVE, nodemask_0, policy, nodemask);
+ MPOL_INTERLEAVE, bind_nodemask, policy, nodemask);
/* Test basic MPOL_BIND policy */
- kvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, &nodemask_0, maxnode, 0);
+ kvm_mbind(mem + page_size * 2, page_size * 2, MPOL_BIND, &bind_nodemask, maxnode, 0);
kvm_get_mempolicy(&policy, &nodemask, maxnode, mem + page_size * 2, MPOL_F_ADDR);
- TEST_ASSERT(policy == MPOL_BIND && nodemask == nodemask_0,
+ TEST_ASSERT(policy == MPOL_BIND && nodemask == bind_nodemask,
"Wanted MPOL_BIND (%u) and nodemask 0x%lx, got %u and 0x%lx",
- MPOL_BIND, nodemask_0, policy, nodemask);
+ MPOL_BIND, bind_nodemask, policy, nodemask);
/* Test MPOL_DEFAULT policy */
kvm_mbind(mem, total_size, MPOL_DEFAULT, NULL, 0, 0);
@@ -112,7 +132,7 @@ static void test_mbind(int fd, size_t total_size)
MPOL_DEFAULT, policy, nodemask);
/* Test with invalid policy */
- ret = mbind(mem, page_size, 999, &nodemask_0, maxnode, 0);
+ ret = mbind(mem, page_size, 999, &bind_nodemask, maxnode, 0);
TEST_ASSERT(ret == -1 && errno == EINVAL,
"mbind with invalid policy should fail with EINVAL");
@@ -121,17 +141,19 @@ static void test_mbind(int fd, size_t total_size)
static void test_numa_allocation(int fd, size_t total_size)
{
- unsigned long node0_mask = 1; /* Node 0 */
- unsigned long node1_mask = 2; /* Node 1 */
- unsigned long maxnode = 8;
+ unsigned long bind_nodemasks[2];
+ unsigned long maxnode = BITS_PER_TYPE(bind_nodemasks[0]) + 1;
void *pages[4];
+ int nids[2];
int status[4];
char *mem;
int i;
- if (!is_multi_numa_node_system())
+ if (!get_numa_node_ids(nids, ARRAY_SIZE(nids)))
return;
+ bind_nodemasks[0] = 1UL << nids[0];
+ bind_nodemasks[1] = 1UL << nids[1];
mem = kvm_mmap(total_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd);
for (i = 0; i < 4; i++)
@@ -139,34 +161,42 @@ static void test_numa_allocation(int fd, size_t total_size)
/* Set NUMA policy after allocation */
memset(mem, 0xaa, page_size);
- kvm_mbind(pages[0], page_size, MPOL_BIND, &node0_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
kvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, page_size);
/* Set NUMA policy before allocation */
- kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &node1_mask, maxnode, 0);
- kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &node0_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &bind_nodemasks[1], maxnode, 0);
+ kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
memset(mem, 0xaa, total_size);
/* Validate if pages are allocated on specified NUMA nodes */
kvm_move_pages(0, 4, pages, NULL, status, 0);
- TEST_ASSERT(status[0] == 1, "Expected page 0 on node 1, got it on node %d", status[0]);
- TEST_ASSERT(status[1] == 1, "Expected page 1 on node 1, got it on node %d", status[1]);
- TEST_ASSERT(status[2] == 0, "Expected page 2 on node 0, got it on node %d", status[2]);
- TEST_ASSERT(status[3] == 0, "Expected page 3 on node 0, got it on node %d", status[3]);
+ TEST_ASSERT(status[0] == nids[1],
+ "Expected page 0 on node %d, got it on node %d", nids[1], status[0]);
+ TEST_ASSERT(status[1] == nids[1],
+ "Expected page 1 on node %d, got it on node %d", nids[1], status[1]);
+ TEST_ASSERT(status[2] == nids[0],
+ "Expected page 2 on node %d, got it on node %d", nids[0], status[2]);
+ TEST_ASSERT(status[3] == nids[0],
+ "Expected page 3 on node %d, got it on node %d", nids[0], status[3]);
/* Punch hole for all pages */
kvm_fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, 0, total_size);
/* Change NUMA policy nodes and reallocate */
- kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &node0_mask, maxnode, 0);
- kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &node1_mask, maxnode, 0);
+ kvm_mbind(pages[0], page_size * 2, MPOL_BIND, &bind_nodemasks[0], maxnode, 0);
+ kvm_mbind(pages[2], page_size * 2, MPOL_BIND, &bind_nodemasks[1], maxnode, 0);
memset(mem, 0xaa, total_size);
kvm_move_pages(0, 4, pages, NULL, status, 0);
- TEST_ASSERT(status[0] == 0, "Expected page 0 on node 0, got it on node %d", status[0]);
- TEST_ASSERT(status[1] == 0, "Expected page 1 on node 0, got it on node %d", status[1]);
- TEST_ASSERT(status[2] == 1, "Expected page 2 on node 1, got it on node %d", status[2]);
- TEST_ASSERT(status[3] == 1, "Expected page 3 on node 1, got it on node %d", status[3]);
+ TEST_ASSERT(status[0] == nids[0],
+ "Expected page 0 on node %d, got it on node %d", nids[0], status[0]);
+ TEST_ASSERT(status[1] == nids[0],
+ "Expected page 1 on node %d, got it on node %d", nids[0], status[1]);
+ TEST_ASSERT(status[2] == nids[1],
+ "Expected page 2 on node %d, got it on node %d", nids[1], status[2]);
+ TEST_ASSERT(status[3] == nids[1],
+ "Expected page 3 on node %d, got it on node %d", nids[1], status[3]);
kvm_munmap(mem, total_size);
}
diff --git a/tools/testing/selftests/kvm/include/numaif.h b/tools/testing/selftests/kvm/include/numaif.h
index 29572a6d789cd..4bbbf314e9d77 100644
--- a/tools/testing/selftests/kvm/include/numaif.h
+++ b/tools/testing/selftests/kvm/include/numaif.h
@@ -4,8 +4,6 @@
#ifndef SELFTEST_KVM_NUMAIF_H
#define SELFTEST_KVM_NUMAIF_H
-#include <dirent.h>
-
#include <linux/mempolicy.h>
#include "kvm_syscalls.h"
@@ -30,54 +28,16 @@ KVM_SYSCALL_DEFINE(mbind, 6, void *, addr, unsigned long, size, int, mode,
const unsigned long *, nodemask, unsigned long, maxnode,
unsigned int, flags);
-static inline int get_max_numa_node(void)
+static inline unsigned long get_numa_mem_nodes(void)
{
- struct dirent *de;
- int max_node = 0;
- DIR *d;
+ unsigned long nodemask = 0;
- /*
- * Assume there's a single node if the kernel doesn't support NUMA,
- * or if no nodes are found.
- */
- d = opendir("/sys/devices/system/node");
- if (!d)
+ /* Get set of first 64 numa nodes available */
+ if (get_mempolicy(NULL, &nodemask, BITS_PER_TYPE(nodemask), NULL,
+ MPOL_F_MEMS_ALLOWED))
return 0;
- while ((de = readdir(d)) != NULL) {
- int node_id;
- char *endptr;
-
- if (strncmp(de->d_name, "node", 4) != 0)
- continue;
-
- node_id = strtol(de->d_name + 4, &endptr, 10);
- if (*endptr != '\0')
- continue;
-
- if (node_id > max_node)
- max_node = node_id;
- }
- closedir(d);
-
- return max_node;
-}
-
-static bool is_numa_available(void)
-{
- /*
- * Probe for NUMA by doing a dummy get_mempolicy(). If the syscall
- * fails with ENOSYS, then the kernel was built without NUMA support.
- * if the syscall fails with EPERM, then the process/user lacks the
- * necessary capabilities (CAP_SYS_NICE).
- */
- return !get_mempolicy(NULL, NULL, 0, NULL, 0) ||
- (errno != ENOSYS && errno != EPERM);
-}
-
-static inline bool is_multi_numa_node_system(void)
-{
- return is_numa_available() && get_max_numa_node() >= 1;
+ return nodemask;
}
#endif /* SELFTEST_KVM_NUMAIF_H */
diff --git a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
index 39ce9a9369f5b..66dcf36398aaa 100644
--- a/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
+++ b/tools/testing/selftests/kvm/x86/xapic_ipi_test.c
@@ -251,8 +251,8 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
u64 *pipis_rcvd)
{
long pages_not_moved;
- unsigned long nodemask = 0;
- unsigned long nodemasks[sizeof(nodemask) * 8];
+ unsigned long nodemask;
+ unsigned long nodemasks[BITS_PER_TYPE(nodemask)];
int nodes = 0;
time_t start_time, last_update, now;
time_t interval_secs = 1;
@@ -266,19 +266,17 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
fprintf(stderr, "Calling migrate_pages every %d microseconds\n",
delay_usecs);
- /* Get set of first 64 numa nodes available */
- kvm_get_mempolicy(NULL, &nodemask, sizeof(nodemask) * 8,
- 0, MPOL_F_MEMS_ALLOWED);
+ nodemask = get_numa_mem_nodes();
fprintf(stderr, "Numa nodes found amongst first %lu possible nodes "
"(each 1-bit indicates node is present): %#lx\n",
- sizeof(nodemask) * 8, nodemask);
+ BITS_PER_TYPE(nodemask), nodemask);
/* Init array of masks containing a single-bit in each, one for each
* available node. migrate_pages called below requires specifying nodes
* as bit masks.
*/
- for (i = 0, bit = 1; i < sizeof(nodemask) * 8; i++, bit <<= 1) {
+ for (i = 0, bit = 1; i < BITS_PER_TYPE(nodemask); i++, bit <<= 1) {
if (nodemask & bit) {
nodemasks[nodes] = nodemask & bit;
nodes++;
@@ -310,7 +308,7 @@ void do_migrations(struct test_data_page *data, int run_secs, int delay_usecs,
* KVM_CREATE_VCPU ioctl. If that assumption ever changes this
* test may break or give a false positive signal.
*/
- pages_not_moved = migrate_pages(0, sizeof(nodemasks[from]),
+ pages_not_moved = migrate_pages(0, BITS_PER_TYPE(nodemasks[from]) + 1,
&nodemasks[from],
&nodemasks[to]);
if (pages_not_moved < 0)
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index f0e5da4908660..f848120af84be 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -721,6 +721,8 @@ static void __kvm_gmem_unbind(struct kvm_memory_slot *slot, struct gmem_file *f)
void kvm_gmem_unbind(struct kvm_memory_slot *slot)
{
+ struct file *gmem_file;
+
/*
* Nothing to do if the underlying file was _already_ closed, as
* kvm_gmem_release() invalidates and nullifies all bindings.
@@ -733,21 +735,24 @@ void kvm_gmem_unbind(struct kvm_memory_slot *slot)
/*
* However, if the file is _being_ closed, then the bindings need to be
* removed as kvm_gmem_release() might not run until after the memslot
- * is freed. Note, modifying the bindings is safe even though the file
- * is dying as kvm_gmem_release() nullifies slot->gmem.file under
+ * is freed. Note, dereferencing the dying file is safe as
+ * kvm_gmem_release() nullifies slot->gmem.file under
* slots_lock, and only puts its reference to KVM after destroying all
* bindings. I.e. reaching this point means kvm_gmem_release() hasn't
* yet destroyed the bindings or freed the gmem_file, and can't do so
* until the caller drops slots_lock.
*/
- if (!file) {
- __kvm_gmem_unbind(slot, slot->gmem.file->private_data);
- return;
- }
+ gmem_file = file ?: slot->gmem.file;
- filemap_invalidate_lock(file->f_mapping);
- __kvm_gmem_unbind(slot, file->private_data);
- filemap_invalidate_unlock(file->f_mapping);
+ /*
+ * Take the invalidate lock even for a dying file. Otherwise,
+ * kvm_gmem_invalidate_start() can find the binding and increment
+ * mmu_invalidate_in_progress while kvm_gmem_invalidate_end() misses
+ * the removed binding and skips decrement.
+ */
+ filemap_invalidate_lock(gmem_file->f_mapping);
+ __kvm_gmem_unbind(slot, gmem_file->private_data);
+ filemap_invalidate_unlock(gmem_file->f_mapping);
}
/* Returns a locked folio on success. */
|
| 19/3 | 2026/08/23 13:51 | llm | kmsan-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7182 output: 151 thoughts: 875 Thoughts: **Analyzing the KVM Guest Memory File Unbinding Patch** Okay, so I'm looking at a patch that touches a few files. The changes in the `tools/testing/selftests/kvm/` directory are just test updates, so they're not the core of what's interesting here. The real meat is in `virt/kvm/guest_memfd.c`. The patch modifies the `kvm_gmem_unbind` function. It seems there's a specific scenario being addressed, where the underlying file associated with a guest memory slot might be in the process of closing. The original code had a check for `file` being NULL. If it was, meaning the file was closing, it would dereference `slot->gmem.file` immediately and call `__kvm_gmem_unbind`. However, it skipped the `filemap_invalidate_lock`. The fix introduces a local `gmem_file` variable and uses either the potentially-NULL `file` from the check or `slot->gmem.file` in case `file` is NULL. The crucial part is that the patch now *always* acquires the `filemap_invalidate_lock` before calling `__kvm_gmem_unbind`, even if the file is being closed. This is all about preventing a race condition within the KVM memory management. The lock is needed because `kvm_gmem_invalidate_start()` might be concurrently incrementing `mmu_invalidate_in_progress`, while we're trying to remove the binding. Without the lock, `kvm_gmem_invalidate_end()` could miss the removed binding and fail to decrement the counter, leading to a potential resource leak or, worse, incorrect memory access. Therefore, this patch is a concurrency issue, a locking problem, not a memory safety one. I can confirm this doesn't appear to be related to uninitialized memory, or any information leak. KASAN/LOCKDEP/etc. might be useful for catching similar issues, or it could be a simple logical bug. So, considering the nature of the issue, this doesn't warrant NeedsKMSAN. |
| 20/3 | 2026/08/23 13:52 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch modifies KVM guest_memfd selftests and fixes a locking/concurrency bug in `kvm_gmem_unbind` in `virt/kvm/guest_memfd.c`. The bug fix ensures that `filemap_invalidate_lock` is taken even when the file is dying, preventing a mismatch in `mmu_invalidate_in_progress` increments/decrements. This is a logic/concurrency issue, not an uninitialized memory read or info-leak. Therefore, KMSAN is not applicable, and standard KASAN/LOCKDEP testing is sufficient.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch modifies KVM guest_memfd selftests and fixes a locking/concurrency bug in `kvm_gmem_unbind` in `virt/kvm/guest_memfd.c`. The bug fix ensures that `filemap_invalidate_lock` is taken even when the file is dying, preventing a mismatch in `mmu_invalidate_in_progress` increments/decrements. This is a logic/concurrency issue, not an uninitialized memory read or info-leak. Therefore, KMSAN is not applicable, and standard KASAN/LOCKDEP testing is sufficient.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|