summaryrefslogtreecommitdiffstats
path: root/virt
diff options
context:
space:
mode:
authorGleb Natapov <gleb@redhat.com>2013-10-01 19:58:36 +0300
committerGleb Natapov <gleb@redhat.com>2013-10-03 10:08:52 +0300
commita2ac07fe292ea41296049dfdbfeed203e2467ee7 (patch)
tree93f6f81ef917245073ffdbc89123dd74cd8ccdd4 /virt
parent517bf8fc211d37d3aa005fb35f9ee7f1d35cb860 (diff)
downloadlinux-a2ac07fe292ea41296049dfdbfeed203e2467ee7.tar.gz
linux-a2ac07fe292ea41296049dfdbfeed203e2467ee7.tar.bz2
linux-a2ac07fe292ea41296049dfdbfeed203e2467ee7.zip
Fix NULL dereference in gfn_to_hva_prot()
gfn_to_memslot() can return NULL or invalid slot. We need to check slot validity before accessing it. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gleb Natapov <gleb@redhat.com>
Diffstat (limited to 'virt')
-rw-r--r--virt/kvm/kvm_main.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 979bff485fb0..a9dd682cf5e3 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1064,10 +1064,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva);
unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
{
struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
- if (writable)
+ unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
+
+ if (!kvm_is_error_hva(hva) && writable)
*writable = !memslot_is_readonly(slot);
- return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false);
+ return hva;
}
static int kvm_read_hva(void *data, void __user *hva, int len)