diff options
| author | Sean Christopherson <seanjc@google.com> | 2023-07-28 18:35:07 -0700 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2023-08-31 13:48:51 -0400 |
| commit | f046923af79158361295ed4f0a588c80b9fdcc1d (patch) | |
| tree | ff3aaa262330b4db36bd5bbd09b27011cfc18a2b /drivers/gpu/drm/i915 | |
| parent | 52e322eda3d475614210efbc0f2793a1da9d367a (diff) | |
| download | linux-stable-f046923af79158361295ed4f0a588c80b9fdcc1d.tar.gz linux-stable-f046923af79158361295ed4f0a588c80b9fdcc1d.tar.bz2 linux-stable-f046923af79158361295ed4f0a588c80b9fdcc1d.zip | |
drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"
Check that the pfn found by gfn_to_pfn() is actually backed by "struct
page" memory prior to retrieving and dereferencing the page. KVM
supports backing guest memory with VM_PFNMAP, VM_IO, etc., and so
there is no guarantee the pfn returned by gfn_to_pfn() has an associated
"struct page".
Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yongwei Ma <yongwei.ma@intel.com>
Reviewed-by: Zhi Wang <zhi.a.wang@intel.com>
Link: https://lore.kernel.org/r/20230729013535.1070024-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/i915')
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 4ec85308379a..58b9b316ae46 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -1183,6 +1183,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu, pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry)); if (is_error_noslot_pfn(pfn)) return -EINVAL; + + if (!pfn_valid(pfn)) + return -EINVAL; + return PageTransHuge(pfn_to_page(pfn)); } |