[PATCH v4 00/23] KVM: Fix+harden against bad uaccess using dying VM · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 01/23] KVM: Reject user accesses to guest memory if current->mm != kvm->mm · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 02/23] KVM: nVMX: Don't force a full nested VM-Exit when destroying a vCPU · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 03/23] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all() · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 04/23] KVM: x86: Drop dead check on an existing memslot not having any pages · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 05/23] KVM: WARN and error out if memslot update encounters existing slot with no pages · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 06/23] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 07/23] KVM: x86: Delete non-SMM internal memslot if creating SMM memslot fails · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 08/23] KVM: x86: Process all address spaces when deleting internal memslot · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 09/23] KVM: x86: Re-queue APICv update request if inhibiting APIC access page fails · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 10/23] KVM: x86: Map a separate VMA for each address space for internal memslots · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 11/23] KVM: Disallow setting memslots when the VM is being destroyed · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 12/23] KVM: Destroy memslots immediately after mmu_notifiers are unregistered · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 13/23] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 14/23] KVM: WARN and reject guest-based uaccess if VM is dying · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 15/23] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 16/23] KVM: VMX: Explicility free vmcs01, not the current VMCS, in vCPU free paths · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 17/23] KVM: nVMX: Don't explicitly VMCLEAR+free() vmcs01's shadow VMCS when freeing vCPU · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 18/23] KVM: nVMX: Cancel the nested VMX Preemption Timer's hrtimer in free_nested() · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 19/23] KVM: Add lockdep-only APIs to query and assert that a vCPU is unreachable · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 20/23] KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 21/23] KVM: nVMX: Don't switch to vmcs01 when freeing a vCPU · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 22/23] KVM: nVMX: Don't load+put the vCPU when freeing nested state for a dying vCPU · Sean Christopherson <seanjc@google.com> · 2026-10-30
[PATCH v4 23/23] KVM: x86: Rename __x86_set_memory_region() => x86_set_internal_memslot() · Sean Christopherson <seanjc@google.com> · 2026-10-30

[PATCH v4 05/23] KVM: WARN and error out if memslot update encounters existing slot with no pages

WARM1d

From: Sean Christopherson <seanjc@google.com>
Date: 2026-10-30 21:21:20
Also in: kvm, lkml
Subsystem: kernel virtual machine (kvm), the rest · Maintainers: Paolo Bonzini, Linus Torvalds

Revision v4 (2 revisions archived).

Revisions (2)

2026-10-01 v2
2026-10-30 v4 current [diff against previous]

WARN and return -EIO if an existing memslot with npages=0 is encountered
when updating memslots, as KVM returns NULL if there is no memslot since
commit 0577d1abe704 ("KVM: Terminate memslot walks via used_slots".  Before
that, KVM pre-allocated all possible memslots and relied on npages==0 to
denote "no valid memslot".  The check on npages was deliberately left
behind to aid debug, but that was over six years ago.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 virt/kvm/kvm_main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 218456372b11..dcd28b45ef30 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c

@@ -2086,9 +2086,11 @@ static int kvm_set_memory_region(struct kvm *kvm,
 	 * and/or destroyed by kvm_set_memslot().
 	 */
 	old = id_to_memslot(slots, id);
+	if (WARN_ON_ONCE(old && !old->npages))
+		return -EIO;
 
 	if (!mem->memory_size) {
-		if (!old || !old->npages)
+		if (!old)
 			return -EINVAL;
 
 		if (WARN_ON_ONCE(kvm->nr_memslot_pages < old->npages))

@@ -2100,7 +2102,7 @@ static int kvm_set_memory_region(struct kvm *kvm,
 	base_gfn = (mem->guest_phys_addr >> PAGE_SHIFT);
 	npages = (mem->memory_size >> PAGE_SHIFT);
 
-	if (!old || !old->npages) {
+	if (!old) {
 		change = KVM_MR_CREATE;
 
 		/*

-- 
2.56.0.385.gac671c819a-goog

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help