diff options
author | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 00:52:29 +0100 |
---|---|---|
committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 01:04:29 +0100 |
commit | 79268e9c62ec6eb6233a85a25c8795fa322aea82 (patch) | |
tree | 7c0245647be63b63ae11cdc1beb3092b81a34fd2 /virt | |
parent | KVM: selftests: Rename 'evmcs_test' to 'hyperv_evmcs' (diff) | |
parent | KVM: Update gfn_to_pfn_cache khva when it moves within the same page (diff) | |
download | linux-79268e9c62ec6eb6233a85a25c8795fa322aea82.tar.xz linux-79268e9c62ec6eb6233a85a25c8795fa322aea82.zip |
Merge branch 'kvm-dwmw2-fixes' into HEAD
This brings in a few important fixes for Xen emulation.
While nobody should be enabling it, the bug effectively
allows userspace to read arbitrary memory.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'virt')
-rw-r--r-- | virt/kvm/pfncache.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c index bd4a46aee384..5f83321bfd2a 100644 --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -297,7 +297,12 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, if (!gpc->valid || old_uhva != gpc->uhva) { ret = hva_to_pfn_retry(kvm, gpc); } else { - /* If the HVA→PFN mapping was already valid, don't unmap it. */ + /* + * If the HVA→PFN mapping was already valid, don't unmap it. + * But do update gpc->khva because the offset within the page + * may have changed. + */ + gpc->khva = old_khva + page_offset; old_pfn = KVM_PFN_ERR_FAULT; old_khva = NULL; ret = 0; |