From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 908C73F44E9 for ; Tue, 2 Jun 2026 17:09:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780420168; cv=none; b=vEnl7oghHwCQWvVg0AkHtotBlvq3YiZ5iJqdEwTaQUJz5d0SkvpBeTMA0i8R2i9mqbkQPCGWlAw2HxX5UsBOvcjS22Kz4Trr2FeE6S2htK+sjr19yKCyl7KQjVsOf2+ggcGY4CxXyLIfuPv+wDc2u/v6nEX19xZD2Oajnm9w63Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780420168; c=relaxed/simple; bh=GCvi8QXTW/Z8JarQzo+uw0cj5SOI/3SJYgspvt0tyXg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=YL/8e+aI1Q790s3mlsAbil8t2BJpoZ2WpYEL3y5oD7qvrvsznyP1os6RLIUbiz4DZajJ/4y+b3/Oos8W3JYIK2L8MCFZhKCaCzyLI6s+1Ye9kO05/WRXNgw94GDaLakBM7DyDVVNT/NRKQ9Yqw3xvvSAOF7ejWRwq8Mfu95TVgw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=f2h+H5dP; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="f2h+H5dP" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2bf1845bddfso48960635ad.1 for ; Tue, 02 Jun 2026 10:09:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780420166; x=1781024966; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:from:to:cc:subject:date:message-id:reply-to; bh=0n2TkN12qK2IJ7MEU6lVCJRDKh5l/P+Za+C9ZbB5kjM=; b=f2h+H5dPhhlqYa5bFCu2f2ZumDar4GBAx48QAdrxBva4f8rnqjsI5H3DRRZJOblpCO qAZqaS0Pu7OlA0Zl5Tdmy4hhrMP4ZppI97ZALLTFge/X/O0/Rb0UHMoxXP+xKrbM6Ekf SsO/XeZavH4UGk+YxObjYvtrsDM6OUFjRKRS0pRCk/AHFg/o3urMlgAnhc9Vd5JsMuA8 l762I+UBcepwPsN86+eBJM2zODHmhoxV4C/MPR8dPSj9Pb1S4HKZQCw7Su/hUhnNIIje qOkuxbS/WsEsjdf23iMEGxAjBDUvs7tXtZaF3/K9LvojxhBGvei+iIhYFSWKTvRa8Uyz dDBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780420166; x=1781024966; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:reply-to:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0n2TkN12qK2IJ7MEU6lVCJRDKh5l/P+Za+C9ZbB5kjM=; b=T6S7fDOoQ+E5qFcVo0VOJRxjlVqTj4v1jSXjMAkyKFXQB1OEQ4aDx7VeEBr/ec68Gx j4FV/C3zI1QX++oRuLUzNSHaOAc2xdvTf+8rLR/NqG65YY7T2xWLEx7YeYpmjizyia1f mR1Ws3u0d+zLRU7+cEdsAs8VkKm7tyYVJ0L0ks3zWRAepDlj5j3sL+f2QYsE3A9x4KjX mnkxLEtDasz60P0CvAcDj2XD8S2lmIbIyWzL82uMXNucxMdWy9x28tHlgDiXLv6Llc2I vKS9kxKfinVqa0s3rZmCGZNlZpqyPEMNlT9ta6s4CcdQUgDe3aPK8oAfqDplFgShiGlU cNzQ== X-Forwarded-Encrypted: i=1; AFNElJ9825w29vgdBQXlSOv2PYsfInFxu/7ClNwqGTw5P44wJr6o3LlVjDy4maBgyFIuCjup9tg4ODUxMWiICJQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxbTHcvkofr5FwbVtx4wOi4w489/lMqmhxeLpneujFxoZ691d2S 3jXcqRqZMvCyAdGQyOIhhyO/VEHGPZ5k8ZKAMDJi6I0kMhrYOK/IrbTlRzzOtT7SbYg7bQnAKiC ufPN4MA== X-Received: from pleb20.prod.google.com ([2002:a17:902:d414:b0:2ba:856e:d046]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:fc43:b0:2c0:a555:80e6 with SMTP id d9443c01a7336-2c0a555946cmr154631085ad.6.1780420165710; Tue, 02 Jun 2026 10:09:25 -0700 (PDT) Reply-To: Sean Christopherson Date: Tue, 2 Jun 2026 10:09:21 -0700 In-Reply-To: <20260602170921.1304394-1-seanjc@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260602170921.1304394-1-seanjc@google.com> X-Mailer: git-send-email 2.54.0.1013.g208068f2d8-goog Message-ID: <20260602170921.1304394-4-seanjc@google.com> Subject: [PATCH v4 3/3] KVM: selftests: Add guest_memfd regression test signed offset+size bug From: Sean Christopherson To: Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Ackerley Tng , Michael Roth , Sean Christopherson Content-Type: text/plain; charset="UTF-8" Add a regression (and proof-of-bug) testcase to ensure KVM rejects an offset+size that would result in a negative value when computed as a signed 64-bit value. KVM had a flaw where it would allow binding a memslot to a guest_memfd instance even with a wildly out-of-range offset, if the offset and size were both positive values, but the combined offset+size was negative. Use "0x7fffffffffffffffull - page_size", i.e. "INT64_MAX - page_size", for the offset as the size of the guest_memfd file must be at least page_size (KVM requires memslots and gmem files to be host page-size aligned). I.e. "INT64_MAX - page_size + size" is guaranteed to generate an offset+size that is negative when converted to a signed 64-bit value *and* honors KVM's alignment requirements. Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Signed-off-by: Sean Christopherson --- tools/testing/selftests/kvm/guest_memfd_test.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tools/testing/selftests/kvm/guest_memfd_test.c b/tools/testing/selftests/kvm/guest_memfd_test.c index 246bb408ecc0..2233d871a38f 100644 --- a/tools/testing/selftests/kvm/guest_memfd_test.c +++ b/tools/testing/selftests/kvm/guest_memfd_test.c @@ -345,6 +345,16 @@ static void test_invalid_punch_hole(int fd, size_t total_size) } } +static void test_invalid_binding(struct kvm_vm *vm, int fd, size_t size) +{ + int r; + + r = __vm_set_user_memory_region2(vm, 0, KVM_MEM_GUEST_MEMFD, 0, size, 0, + fd, ALIGN_DOWN(INT64_MAX, page_size)); + TEST_ASSERT(r && errno == EINVAL, + "Memslot with out-of-range offset+size should fail"); +} + static void test_create_guest_memfd_invalid_sizes(struct kvm_vm *vm, u64 guest_memfd_flags) { @@ -456,6 +466,7 @@ static void __test_guest_memfd(struct kvm_vm *vm, u64 flags) gmem_test(file_size, vm, flags); gmem_test(fallocate, vm, flags); gmem_test(invalid_punch_hole, vm, flags); + gmem_test_vm(invalid_binding, vm, flags); } static void test_guest_memfd(unsigned long vm_type) -- 2.54.0.929.g9b7fa37559-goog