Re: [PATCH v8 18/46] KVM: guest_memfd: Handle lru_add fbatch refcounts during conversion safety check
From: Binbin Wu <hidden>
Date: 2026-06-23 09:48:39
Also in:
kvm, linux-coco, linux-doc, linux-kselftest, linux-mm, lkml
On 6/19/2026 8:31 AM, Ackerley Tng via B4 Relay wrote:
quoted hunk ↗ jump to hunk
@@ -606,12 +608,20 @@ static bool kvm_gmem_is_safe_for_conversion(struct inode *inode, pgoff_t start, next = start; while (safe && filemap_get_folios(mapping, &next, last, &fbatch)) { - for (i = 0; i < folio_batch_count(&fbatch); ++i) { + for (i = 0; i < folio_batch_count(&fbatch);) { struct folio *folio = fbatch.folios[i]; - if (folio_ref_count(folio) != - folio_nr_pages(folio) + filemap_get_folios_refcount) { - safe = false; + safe = (folio_ref_count(folio) == + folio_nr_pages(folio) + + filemap_get_folios_refcount); + + if (safe) { + ++i; + } else if (folio_may_be_lru_cached(folio) && + !lru_drained) { + lru_add_drain_all();
It seems unprivileged userspace is able to trigger lru_add_drain_all() repeatedly by invoking KVM_SET_MEMORY_ATTRIBUTES2 in a loop, which could lead to DoS risk?
+ lru_drained = true;
+ } else {
*err_index = max(start, folio->index);
break;
}