Skip to content

Commit f046923

Browse files
sean-jcbonzini
authored andcommitted
drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"
Check that the pfn found by gfn_to_pfn() is actually backed by "struct page" memory prior to retrieving and dereferencing the page. KVM supports backing guest memory with VM_PFNMAP, VM_IO, etc., and so there is no guarantee the pfn returned by gfn_to_pfn() has an associated "struct page". Fixes: b901b25 ("drm/i915/gvt: Add 2M huge gtt support") Reviewed-by: Yan Zhao <yan.y.zhao@intel.com> Tested-by: Yongwei Ma <yongwei.ma@intel.com> Reviewed-by: Zhi Wang <zhi.a.wang@intel.com> Link: https://lore.kernel.org/r/20230729013535.1070024-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 52e322e commit f046923

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

  • drivers/gpu/drm/i915/gvt

drivers/gpu/drm/i915/gvt/gtt.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1183,6 +1183,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu,
11831183
pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry));
11841184
if (is_error_noslot_pfn(pfn))
11851185
return -EINVAL;
1186+
1187+
if (!pfn_valid(pfn))
1188+
return -EINVAL;
1189+
11861190
return PageTransHuge(pfn_to_page(pfn));
11871191
}
11881192

0 commit comments

Comments
 (0)