diff options
| author | Peter Xu <peterx@redhat.com> | 2020-04-16 18:59:10 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2020-05-15 19:26:15 +0300 |
| commit | 0fd460446912dd96fd1e08995f57b14806c10478 (patch) | |
| tree | e8e654b6096da7f83ef30b9f924ebe25cd57b67b /arch/x86/kvm | |
| parent | 5b494aea13fe9ec67365510c0d75835428cbb303 (diff) | |
| download | linux-0fd460446912dd96fd1e08995f57b14806c10478.tar.xz | |
KVM: X86: Sanity check on gfn before removal
The index returned by kvm_async_pf_gfn_slot() will be removed when an
async pf gfn is going to be removed. However kvm_async_pf_gfn_slot()
is not reliable in that it can return the last key it loops over even
if the gfn is not found in the async gfn array. It should never
happen, but it's still better to sanity check against that to make
sure no unexpected gfn will be removed.
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20200416155910.267514-1-peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch/x86/kvm')
| -rw-r--r-- | arch/x86/kvm/x86.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 8e28f21fb39b..370288fdedba 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10353,6 +10353,10 @@ static void kvm_del_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn) u32 i, j, k; i = j = kvm_async_pf_gfn_slot(vcpu, gfn); + + if (WARN_ON_ONCE(vcpu->arch.apf.gfns[i] != gfn)) + return; + while (true) { vcpu->arch.apf.gfns[i] = ~0; do { |