From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9428C7461 for ; Sun, 17 Sep 2023 20:07:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C817FC433C7; Sun, 17 Sep 2023 20:07:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1694981243; bh=LCCw8kkN5lY6JAqJAa6t0bDmWaFxhthOz9RY5ndBrCU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BoXptm9nVeUX7xhZISn4UrQbgGRN3HLCB8l4ijUZ5e9rO4zb3VRhJ7a7oU93wOdTR VJG5ok/e8XutjufYrLkoQ98m3HJdyz07mRMV/erZ1oLE5DOn8iAKKToMIkpYIYhGqD Pc0paLIrM/u2eiAulr/bEEVlTeiiiBAGthSD6NlU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yan Zhao , Yongwei Ma , Zhi Wang , Sean Christopherson , Paolo Bonzini , Sasha Levin Subject: [PATCH 6.1 094/219] drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page" Date: Sun, 17 Sep 2023 21:13:41 +0200 Message-ID: <20230917191044.377917495@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20230917191040.964416434@linuxfoundation.org> References: <20230917191040.964416434@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sean Christopherson [ Upstream commit f046923af79158361295ed4f0a588c80b9fdcc1d ] Check that the pfn found by gfn_to_pfn() is actually backed by "struct page" memory prior to retrieving and dereferencing the page. KVM supports backing guest memory with VM_PFNMAP, VM_IO, etc., and so there is no guarantee the pfn returned by gfn_to_pfn() has an associated "struct page". Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Reviewed-by: Yan Zhao Tested-by: Yongwei Ma Reviewed-by: Zhi Wang Link: https://lore.kernel.org/r/20230729013535.1070024-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin --- drivers/gpu/drm/i915/gvt/gtt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 80c60754a5c1c..92462cd4bf7cc 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -1188,6 +1188,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu, pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry)); if (is_error_noslot_pfn(pfn)) return -EINVAL; + + if (!pfn_valid(pfn)) + return -EINVAL; + return PageTransHuge(pfn_to_page(pfn)); } -- 2.40.1