diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 02:52:29 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-11-24 03:04:29 +0300 |
| commit | 79268e9c62ec6eb6233a85a25c8795fa322aea82 (patch) | |
| tree | 7c0245647be63b63ae11cdc1beb3092b81a34fd2 /virt | |
| parent | 0fa32dad1e78629cb42999dacd82489503fdf4c2 (diff) | |
| parent | 8332f0ed4f187c7b700831bd7cc83ce180a944b9 (diff) | |
| download | linux-79268e9c62ec6eb6233a85a25c8795fa322aea82.tar.xz | |
Merge branch 'kvm-dwmw2-fixes' into HEAD
This brings in a few important fixes for Xen emulation.
While nobody should be enabling it, the bug effectively
allows userspace to read arbitrary memory.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'virt')
| -rw-r--r-- | virt/kvm/pfncache.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/virt/kvm/pfncache.c b/virt/kvm/pfncache.c index bd4a46aee384..5f83321bfd2a 100644 --- a/virt/kvm/pfncache.c +++ b/virt/kvm/pfncache.c @@ -297,7 +297,12 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, if (!gpc->valid || old_uhva != gpc->uhva) { ret = hva_to_pfn_retry(kvm, gpc); } else { - /* If the HVA→PFN mapping was already valid, don't unmap it. */ + /* + * If the HVA→PFN mapping was already valid, don't unmap it. + * But do update gpc->khva because the offset within the page + * may have changed. + */ + gpc->khva = old_khva + page_offset; old_pfn = KVM_PFN_ERR_FAULT; old_khva = NULL; ret = 0; |