set_memory_region_test covers creating a private memslot and rejecting
overlapping private regions, but nothing exercises a FLAGS_ONLY update
that toggles KVM_MEM_GUEST_MEMFD on a slot that already exists.
Add test_toggle_private_memory_region() to close that gap. It asserts
both directions are rejected with EINVAL:
1. clearing KVM_MEM_GUEST_MEMFD on a private slot;
2. setting KVM_MEM_GUEST_MEMFD on a slot created without it.
Both are enforced by the flags mask in kvm_set_memory_region():
(mem->flags ^ old->flags) & (KVM_MEM_READONLY | KVM_MEM_GUEST_MEMFD)
which gained KVM_MEM_GUEST_MEMFD in commit 9935df5333aa ("KVM: Disallow
toggling KVM_MEM_GUEST_MEMFD on an existing memslot"). Before that
commit, direction 1 freed the old slot without calling kvm_gmem_unbind(),
so closing the guest_memfd afterwards wrote to freed memory; the fix
commit records the resulting KASAN slab-use-after-free in
kvm_gmem_release().
The test runs only when KVM_X86_SW_PROTECTED_VM is available, alongside
the existing private-memslot tests.
Signed-off-by: Valery Borovsky <[email protected]>
---
Built and run on x86_64 against a 7.0 kernel; the new subtest passes.
.../selftests/kvm/set_memory_region_test.c | 45 +++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/tools/testing/selftests/kvm/set_memory_region_test.c
b/tools/testing/selftests/kvm/set_memory_region_test.c
index a152ab65c657..8fb2e7a96f6c 100644
--- a/tools/testing/selftests/kvm/set_memory_region_test.c
+++ b/tools/testing/selftests/kvm/set_memory_region_test.c
@@ -500,6 +500,50 @@ static void test_add_private_memory_region(void)
kvm_vm_free(vm);
}
+static void test_toggle_private_memory_region(void)
+{
+ struct kvm_vm *vm;
+ int memfd, r;
+
+ pr_info("Testing that toggling KVM_MEM_GUEST_MEMFD on existing slot is
rejected\n");
+
+ vm = vm_create_barebones_type(KVM_X86_SW_PROTECTED_VM);
+ memfd = vm_create_guest_memfd(vm, MEM_REGION_SIZE, 0);
+
+ /* Create a private slot. */
+ vm_set_user_memory_region2(vm, MEM_REGION_SLOT, KVM_MEM_GUEST_MEMFD,
+ MEM_REGION_GPA, MEM_REGION_SIZE,
+ 0, memfd, 0);
+
+ /*
+ * Attempt a FLAGS_ONLY update that clears KVM_MEM_GUEST_MEMFD.
+ * Must fail with EINVAL. Before commit 9935df5333aa this caused
+ * a slab-use-after-free in kvm_gmem_release() because the old slot
+ * was freed without calling kvm_gmem_unbind().
+ */
+ r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT, 0,
+ MEM_REGION_GPA, MEM_REGION_SIZE,
+ 0, memfd, 0);
+ TEST_ASSERT(r == -1 && errno == EINVAL,
+ "Clearing KVM_MEM_GUEST_MEMFD should have failed with
EINVAL, got r=%d errno=%d", r, errno);
+
+ /*
+ * Symmetrically, attempting to set KVM_MEM_GUEST_MEMFD on a slot
+ * that was created without it must also be rejected.
+ */
+ vm_set_user_memory_region(vm, MEM_REGION_SLOT + 1, 0,
+ MEM_REGION_GPA * 2, MEM_REGION_SIZE, NULL);
+ r = __vm_set_user_memory_region2(vm, MEM_REGION_SLOT + 1,
+ KVM_MEM_GUEST_MEMFD,
+ MEM_REGION_GPA * 2, MEM_REGION_SIZE,
+ 0, memfd, 0);
+ TEST_ASSERT(r == -1 && errno == EINVAL,
+ "Setting KVM_MEM_GUEST_MEMFD should have failed with
EINVAL, got r=%d errno=%d", r, errno);
+
+ close(memfd);
+ kvm_vm_free(vm);
+}
+
static void test_add_overlapping_private_memory_regions(void)
{
struct kvm_vm *vm;
@@ -645,6 +689,7 @@ int main(int argc, char *argv[])
(kvm_check_cap(KVM_CAP_VM_TYPES) & BIT(KVM_X86_SW_PROTECTED_VM))) {
test_add_private_memory_region();
test_add_overlapping_private_memory_regions();
+ test_toggle_private_memory_region();
} else {
pr_info("Skipping tests for KVM_MEM_GUEST_MEMFD memory
regions\n");
}
--
2.53.0
