Re: [PATCH] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying

[Sean Christopherson]

On Mon, 03 Nov 2025 17:12:05 -0800, Sean Christopherson wrote:
> When unbinding a memslot from a guest_memfd instance, remove the bindings
> even if the guest_memfd file is dying, i.e. even if its file refcount has
> gone to zero.  If the memslot is freed before the file is fully released,
> nullifying the memslot side of the binding in kvm_gmem_release() will
> write to freed memory, as detected by syzbot+KASAN:
> 
>   ==================================================================
>   BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353
>   Write of size 8 at addr ffff88807befa508 by task syz.0.17/6022
> 
> [...]

Applied to kvm-x86 fixes, with a tweaked comment to clarify that the bindings
and file haven't yet been destroyed/freed (and can't be destroyed/freed
concurrently either).

	/*
	 * However, if the file is _being_ closed, then the bindings need to be
	 * removed as kvm_gmem_release() might not run until after the memslot
	 * is freed.  Note, modifying the bindings is safe even though the file
	 * is dying as kvm_gmem_release() nullifies slot->gmem.file under
	 * slots_lock, and only puts its reference to KVM after destroying all
	 * bindings.  I.e. reaching this point means kvm_gmem_release() hasn't
	 * yet destroyed the bindings or freed the gmem_file, and can't do so
	 * until the caller drops slots_lock.
	 */

Thanks!

[1/1] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
      https://github.com/kvm-x86/linux/commit/ae431059e75d

--
https://github.com/kvm-x86/linux/tree/next