diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 02:52:29 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 02:59:45 +0300 |
| commit | fe08e36be9ecbf6b38714a77c97b1d25b7a6e4b0 (patch) | |
| tree | 9ad343989dfe2029c80f8e4f86c828504edba428 /virt | |
| parent | 47b0c2e4c220f2251fd8dcfbb44479819c715e15 (diff) | |
| parent | 8332f0ed4f187c7b700831bd7cc83ce180a944b9 (diff) | |
| download | linux-fe08e36be9ecbf6b38714a77c97b1d25b7a6e4b0.tar.xz | |
Merge branch 'kvm-dwmw2-fixes' into HEAD
This brings in a few important fixes for Xen emulation.
While nobody should be enabling it, the bug effectively
allows userspace to read arbitrary memory.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'virt')
| -rw-r--r-- | virt/kvm/pfncache.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c index 346e47f15572..7c248193ca26 100644 --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -297,7 +297,12 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, if (!gpc->valid || old_uhva != gpc->uhva) { ret = hva_to_pfn_retry(kvm, gpc); } else { - /* If the HVA→PFN mapping was already valid, don't unmap it. */ + /* + * If the HVA→PFN mapping was already valid, don't unmap it. + * But do update gpc->khva because the offset within the page + * may have changed. + */ + gpc->khva = old_khva + page_offset; old_pfn = KVM_PFN_ERR_FAULT; old_khva = NULL; ret = 0; |