Commit f4501e8b authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

Merge tag 'kvm-x86-fixes-6.10-11' of https://github.com/kvm-x86/linux into HEAD 

KVM Xen:

Fix a bug where KVM fails to check the validity of an incoming userspace
virtual address and tries to activate a gfn_to_pfn_cache with a kernel address.
parents 1c5a0b55 ebbdf37c

arch/x86/kvm/xen.c

+1 −1
Original line number Diff line number Diff line
@@ -741,7 +741,7 @@ int kvm_xen_hvm_set_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data) 
		} else {

			void __user * hva = u64_to_user_ptr(data->u.shared_info.hva);



			if (!PAGE_ALIGNED(hva) || !access_ok(hva, PAGE_SIZE)) {

			if (!PAGE_ALIGNED(hva)) {

				r = -EINVAL;

			} else if (!hva) {

				kvm_gpc_deactivate(&kvm->arch.xen.shinfo_cache);

virt/kvm/pfncache.c

+3 −0
Original line number Diff line number Diff line
@@ -430,6 +430,9 @@ int kvm_gpc_activate(struct gfn_to_pfn_cache *gpc, gpa_t gpa, unsigned long len) 


int kvm_gpc_activate_hva(struct gfn_to_pfn_cache *gpc, unsigned long uhva, unsigned long len)

{

	if (!access_ok((void __user *)uhva, len))

		return -EINVAL;



	return __kvm_gpc_activate(gpc, INVALID_GPA, uhva, len);

}