diff options
| author | Pei Li <peili.dev@gmail.com> | 2024-06-27 08:03:56 -0700 |
|---|---|---|
| committer | Sean Christopherson <seanjc@google.com> | 2024-06-28 08:31:46 -0700 |
| commit | ebbdf37ce9abb597015fa85df6630ebfa7d0a97f (patch) | |
| tree | 03e311b026e64aa8a378e7d3b19e676ea7b17e0d /arch/x86/kvm/xen.c | |
| parent | dee67a94d4c6cbd05b8f6e1181498e94caa33334 (diff) | |
| download | linux-ebbdf37ce9abb597015fa85df6630ebfa7d0a97f.tar.gz linux-ebbdf37ce9abb597015fa85df6630ebfa7d0a97f.tar.bz2 linux-ebbdf37ce9abb597015fa85df6630ebfa7d0a97f.zip | |
KVM: Validate hva in kvm_gpc_activate_hva() to fix __kvm_gpc_refresh() WARN
Check that the virtual address is "ok" when activating a gfn_to_pfn_cache
with a host VA to ensure that KVM never attempts to use a bad address.
This fixes a bug where KVM fails to check the incoming address when
handling KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO_HVA in kvm_xen_vcpu_set_attr().
Reported-by: syzbot+fd555292a1da3180fc82@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd555292a1da3180fc82
Tested-by: syzbot+fd555292a1da3180fc82@syzkaller.appspotmail.com
Signed-off-by: Pei Li <peili.dev@gmail.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Link: https://lore.kernel.org/r/20240627-bug5-v2-1-2c63f7ee6739@gmail.com
[sean: rewrite changelog with --verbose]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Diffstat (limited to 'arch/x86/kvm/xen.c')
| -rw-r--r-- | arch/x86/kvm/xen.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index f65b35a05d91..67bb4e89c399 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -741,7 +741,7 @@ int kvm_xen_hvm_set_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data) } else { void __user * hva = u64_to_user_ptr(data->u.shared_info.hva); - if (!PAGE_ALIGNED(hva) || !access_ok(hva, PAGE_SIZE)) { + if (!PAGE_ALIGNED(hva)) { r = -EINVAL; } else if (!hva) { kvm_gpc_deactivate(&kvm->arch.xen.shinfo_cache); |