Skip to content

Commit 5717e38

Browse files
committed
fix(hiding_ci): race condition in write syscall
Do this by implementing write_iter instead that takes care about folio locking and potential prefaulting of the user buffer. Signed-off-by: Nikita Kalyazin <[email protected]>
1 parent ca6a13b commit 5717e38

File tree

2 files changed

+67
-87
lines changed

2 files changed

+67
-87
lines changed

resources/hiding_ci/linux_patches/20-gmem-write/0039-KVM-guest_memfd-add-generic-population-via-write.patch

Lines changed: 63 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
From 859e9756eb70cfc8cf4fb4f0870908e55521cc7f Mon Sep 17 00:00:00 2001
1+
From 50edda43ef63a1026f59f3cf7ebe80a810a65927 Mon Sep 17 00:00:00 2001
22
From: Nikita Kalyazin <[email protected]>
33
Date: Mon, 3 Mar 2025 13:08:37 +0000
4-
Subject: [PATCH 39/46] KVM: guest_memfd: add generic population via write
4+
Subject: [PATCH 1/2] KVM: guest_memfd: add generic population via write
55

66
write syscall populates guest_memfd with user-supplied data in a generic
77
way, ie no vendor-specific preparation is performed. This is supposed
@@ -18,109 +18,89 @@ The following behaviour is implemented:
1818

1919
Signed-off-by: Nikita Kalyazin <[email protected]>
2020
---
21-
virt/kvm/guest_memfd.c | 88 +++++++++++++++++++++++++++++++++++++++++-
22-
1 file changed, 87 insertions(+), 1 deletion(-)
21+
virt/kvm/guest_memfd.c | 55 +++++++++++++++++++++++++++++++++++++++++-
22+
1 file changed, 54 insertions(+), 1 deletion(-)
2323

2424
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
25-
index d70ee66bb96d..809da2a2fb37 100644
25+
index d70ee66bb96d..81eb05028d0b 100644
2626
--- a/virt/kvm/guest_memfd.c
2727
+++ b/virt/kvm/guest_memfd.c
28-
@@ -392,8 +392,93 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
29-
return 0;
28+
@@ -393,7 +393,9 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
3029
}
3130

32-
+static ssize_t kvm_kmem_gmem_write(struct file *file, const char __user *buf,
33-
+ size_t count, loff_t *offset)
31+
static struct file_operations kvm_gmem_fops = {
32+
- .mmap = kvm_gmem_mmap,
33+
+ .mmap = kvm_gmem_mmap,
34+
+ .llseek = default_llseek,
35+
+ .write_iter = generic_perform_write,
36+
.open = generic_file_open,
37+
.release = kvm_gmem_release,
38+
.fallocate = kvm_gmem_fallocate,
39+
@@ -404,6 +406,54 @@ void kvm_gmem_init(struct module *module)
40+
kvm_gmem_fops.owner = module;
41+
}
42+
43+
+static int kvm_kmem_gmem_write_begin(struct file *file, struct address_space *mapping,
44+
+ loff_t pos, unsigned len, struct folio **foliop,
45+
+ void **fsdata)
3446
+{
35-
+ pgoff_t start, end, index;
36-
+ ssize_t ret = 0;
47+
+ pgoff_t index = pos >> PAGE_SHIFT;
48+
+ struct folio *folio;
3749
+
38-
+ if (!PAGE_ALIGNED(*offset) || !PAGE_ALIGNED(count))
50+
+ if (!PAGE_ALIGNED(pos) || len != PAGE_SIZE)
3951
+ return -EINVAL;
4052
+
41-
+ if (*offset + count > i_size_read(file_inode(file)))
53+
+ if (pos + len > i_size_read(file_inode(file)))
4254
+ return -EINVAL;
4355
+
44-
+ if (!buf)
45-
+ return -EINVAL;
46-
+
47-
+ start = *offset >> PAGE_SHIFT;
48-
+ end = (*offset + count) >> PAGE_SHIFT;
49-
+
50-
+ filemap_invalidate_lock_shared(file->f_mapping);
51-
+
52-
+ for (index = start; index < end; ) {
53-
+ struct folio *folio;
54-
+ void *vaddr;
55-
+ pgoff_t buf_offset = (index - start) << PAGE_SHIFT;
56-
+
57-
+ if (signal_pending(current)) {
58-
+ ret = -EINTR;
59-
+ goto out;
60-
+ }
56+
+ folio = kvm_gmem_get_folio(file_inode(file), index);
57+
+ if (IS_ERR(folio))
58+
+ return -EFAULT;
6159
+
62-
+ folio = kvm_gmem_get_folio(file_inode(file), index);
63-
+ if (IS_ERR(folio)) {
64-
+ ret = -EFAULT;
65-
+ goto out;
66-
+ }
67-
+
68-
+ if (folio_test_hwpoison(folio)) {
69-
+ folio_unlock(folio);
70-
+ folio_put(folio);
71-
+ ret = -EFAULT;
72-
+ goto out;
73-
+ }
74-
+
75-
+ /* No support for huge pages. */
76-
+ if (WARN_ON_ONCE(folio_test_large(folio))) {
77-
+ folio_unlock(folio);
78-
+ folio_put(folio);
79-
+ ret = -EFAULT;
80-
+ goto out;
81-
+ }
82-
+
83-
+ if (folio_test_uptodate(folio)) {
84-
+ folio_unlock(folio);
85-
+ folio_put(folio);
86-
+ ret = -ENOSPC;
87-
+ goto out;
88-
+ }
60+
+ if (WARN_ON_ONCE(folio_test_large(folio))) {
61+
+ folio_unlock(folio);
62+
+ folio_put(folio);
63+
+ return -EFAULT;
64+
+ }
8965
+
66+
+ if (folio_test_uptodate(folio)) {
9067
+ folio_unlock(folio);
68+
+ folio_put(folio);
69+
+ return -ENOSPC;
70+
+ }
9171
+
92-
+ vaddr = kmap_local_folio(folio, 0);
93-
+ ret = copy_from_user(vaddr, buf + buf_offset, PAGE_SIZE);
94-
+ kunmap_local(vaddr);
95-
+ if (ret) {
96-
+ ret = -EINVAL;
97-
+ folio_put(folio);
98-
+ goto out;
99-
+ }
72+
+ *foliop = folio;
73+
+ return 0;
74+
+}
10075
+
76+
+static int kvm_kmem_gmem_write_end(struct file *file, struct address_space *mapping,
77+
+ loff_t pos, unsigned len, unsigned copied,
78+
+ struct folio *folio, void *fsdata)
79+
+{
80+
+ if (copied == len)
10181
+ kvm_gmem_mark_prepared(folio);
102-
+ folio_put(folio);
103-
+
104-
+ index = folio_next_index(folio);
105-
+ *offset += PAGE_SIZE;
106-
+ }
82+
+ else
83+
+ filemap_remove_folio(folio);
10784
+
108-
+out:
109-
+ filemap_invalidate_unlock_shared(file->f_mapping);
85+
+ folio_unlock(folio);
86+
+ folio_put(folio);
11087
+
111-
+ return ret && start == (*offset >> PAGE_SHIFT) ?
112-
+ ret : *offset - (start << PAGE_SHIFT);
88+
+ return copied;
11389
+}
11490
+
115-
static struct file_operations kvm_gmem_fops = {
116-
- .mmap = kvm_gmem_mmap,
117-
+ .mmap = kvm_gmem_mmap,
118-
+ .llseek = default_llseek,
119-
+ .write = kvm_kmem_gmem_write,
120-
.open = generic_file_open,
121-
.release = kvm_gmem_release,
122-
.fallocate = kvm_gmem_fallocate,
123-
@@ -514,6 +599,7 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
91+
static int kvm_gmem_migrate_folio(struct address_space *mapping,
92+
struct folio *dst, struct folio *src,
93+
enum migrate_mode mode)
94+
@@ -463,6 +513,8 @@ static void kvm_gmem_free_folio(struct address_space *mapping,
95+
96+
static const struct address_space_operations kvm_gmem_aops = {
97+
.dirty_folio = noop_dirty_folio,
98+
+ .write_begin = kvm_kmem_gmem_write_begin,
99+
+ .write_end = kvm_kmem_gmem_write_end,
100+
.migrate_folio = kvm_gmem_migrate_folio,
101+
.error_remove_folio = kvm_gmem_error_folio,
102+
.free_folio = kvm_gmem_free_folio,
103+
@@ -514,6 +566,7 @@ static int __kvm_gmem_create(struct kvm *kvm, loff_t size, u64 flags)
124104
}
125105

126106
file->f_flags |= O_LARGEFILE;

resources/hiding_ci/linux_patches/20-gmem-write/0040-KVM-selftests-update-guest_memfd-write-tests.patch

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
From 205f30ad3c9fa142c34ab2ac6a3f6a762f6fc6b1 Mon Sep 17 00:00:00 2001
1+
From 5d2885cd8a7904642d0c92d4464a74fedb167ddd Mon Sep 17 00:00:00 2001
22
From: Nikita Kalyazin <[email protected]>
33
Date: Mon, 3 Mar 2025 13:08:38 +0000
4-
Subject: [PATCH 40/46] KVM: selftests: update guest_memfd write tests
4+
Subject: [PATCH 2/2] KVM: selftests: update guest_memfd write tests
55

66
This is to reflect that the write syscall is now implemented for
77
guest_memfd.
@@ -12,7 +12,7 @@ Signed-off-by: Nikita Kalyazin <[email protected]>
1212
1 file changed, 79 insertions(+), 6 deletions(-)
1313

1414
diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c
15-
index 1252e74fbb8f..3965a842896e 100644
15+
index 1252e74fbb8f..4c8eccd751d9 100644
1616
--- a/tools/testing/selftests/kvm/guest_memfd_test.c
1717
+++ b/tools/testing/selftests/kvm/guest_memfd_test.c
1818
@@ -22,18 +22,90 @@
@@ -59,7 +59,7 @@ index 1252e74fbb8f..3965a842896e 100644
5959
+
6060
+ ret = pwrite(fd, NULL, page_size, 0);
6161
+ TEST_ASSERT(ret == -1, "supplying a NULL buffer when writing a guest_mem fd should fail");
62-
+ TEST_ASSERT_EQ(errno, EINVAL);
62+
+ TEST_ASSERT_EQ(errno, EFAULT);
6363
+
6464
+ /* Check double population is not allowed */
6565
+

0 commit comments

Comments
 (0)