Fix a bug introduced by dynamic memslot allocation where the LRU slot can become invalid and lead to a out-of-bounds/use-after-free scenario. The patch is different that what Qian has already tested, but I was able to reproduce the bad behavior by enhancing the set memory region selftest, i.e. I'm relatively confident the bug is fixed. Patches 2-6 are a variety of selftest cleanup, with the aforementioned set memory region enhancement coming in patch 7. Note, I couldn't get the selftest to fail outright or with KASAN, but was able to hit a WARN_ON an invalid slot 100% of the time (without the fix, obviously). Regarding s390, I played around a bit with merging gfn_to_memslot_approx() into search_memslots(). Code wise it's trivial since they're basically identical, but doing so increases the code footprint of search_memslots() on x86 by 30 bytes, so I ended up abandoning the effort. Sean Christopherson (7): KVM: Fix out of range accesses to memslots KVM: selftests: Fix cosmetic copy-paste error in vm_mem_region_move() KVM: selftests: Take vcpu pointer instead of id in vm_vcpu_rm() KVM: selftests: Add helpers to consolidate open coded list operations KVM: selftests: Add util to delete memory region KVM: selftests: Expose the primary memslot number to tests KVM: selftests: Add "delete" testcase to set_memory_region_test arch/s390/kvm/kvm-s390.c | 3 + include/linux/kvm_host.h | 3 + .../testing/selftests/kvm/include/kvm_util.h | 3 + tools/testing/selftests/kvm/lib/kvm_util.c | 139 ++++++++++-------- .../kvm/x86_64/set_memory_region_test.c | 122 +++++++++++++-- virt/kvm/kvm_main.c | 3 + 6 files changed, 201 insertions(+), 72 deletions(-) -- 2.24.1
