Forwarded: [PATCH] KVM: guest_memfd: Prevent THP collapse of guest_memfd pages

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: [PATCH] KVM: guest_memfd: Prevent THP collapse of guest_memfd pages
Author: kartikey406@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

guest_memfd fault handler kvm_gmem_fault_user_mapping() does not support
large folios and warns via WARN_ON_ONCE(folio_test_large(folio)).

When a guest_memfd mapping has VM_HUGEPAGE set via madvise(MADV_HUGEPAGE),
khugepaged or MADV_COLLAPSE can collapse small pages into a large folio
in the page cache. This happens because file_thp_enabled() incorrectly
returns true for guest_memfd inodes when CONFIG_READ_ONLY_THP_FOR_FS is
enabled. A subsequent page fault finds the large folio and triggers the
warning.

Fix this by setting VM_NO_KHUGEPAGED on the VMA in kvm_gmem_mmap().
This causes __thp_vma_allowable_orders() to reject THP early for both
MADV_COLLAPSE and khugepaged. The page fault path is unaffected since
guest_memfd does not define a huge_fault handler.

Reported-by: syzbot+33a04338019ac7e43a44@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44
Signed-off-by: Deepanshu Kartikey <Kartikey406@xxxxxxxxx>
---
 virt/kvm/guest_memfd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index fdaea3422c30..94ac360afe79 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -474,12 +474,13 @@ static int kvm_gmem_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	if (!kvm_gmem_supports_mmap(file_inode(file)))
 		return -ENODEV;
-
+	
 	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) !=
 	    (VM_SHARED | VM_MAYSHARE)) {
 		return -EINVAL;
 	}
 
+	vm_flags_set(vma, VM_NO_KHUGEPAGED);
 	vma->vm_ops = &kvm_gmem_vm_ops;
 
 	return 0;
-- 
2.43.0