Forwarded: [PATCH] INFO: task hung in kvm_gmem_release (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [PATCH] INFO: task hung in kvm_gmem_release (2)
Author: jchuang26@xxxxxxxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Reported-by: syzbot+ab6273c58262b9de56d9@xxxxxxxxxxxxxxxxxxxxxxxxx

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 65eb26a05..ad5852f49 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2572,8 +2572,18 @@ static int kvm_vm_set_mem_attributes(struct kvm *kvm, gfn_t start, gfn_t end,
 	/*
 	 * Reserve memory ahead of time to avoid having to deal with failures
 	 * partway through setting the new attributes.
+	 *
+	 * The requested range can be arbitrarily large, so allow userspace to
+	 * abort the reservation loop with a signal.  Otherwise the loop can run
+	 * for an extended period of time while holding slots_lock, which blocks
+	 * tasks such as kvm_gmem_release() and triggers hung task warnings.
 	 */
 	for (i = start; i < end; i++) {
+		if (signal_pending(current)) {
+			r = -EINTR;
+			goto out_unlock;
+		}
+
 		r = xa_reserve(&kvm->mem_attr_array, i, GFP_KERNEL_ACCOUNT);
 		if (r)
 			goto out_unlock;
@@ -2612,6 +2622,14 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
 	if (!PAGE_ALIGNED(attrs->address) || !PAGE_ALIGNED(attrs->size))
 		return -EINVAL;
 
+	/*
+	 * KVM processes the range one gfn at a time while holding slots_lock.
+	 * Reject absurdly large requests, using the same limit as memory
+	 * regions, so that userspace can't hang tasks that need slots_lock.
+	 */
+	if ((attrs->size >> PAGE_SHIFT) > KVM_MEM_MAX_NR_PAGES)
+		return -EINVAL;
+
 	start = attrs->address >> PAGE_SHIFT;
 	end = (attrs->address + attrs->size) >> PAGE_SHIFT;