Re: [PATCH v2 4.19 3/3] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()

[Greg KH <greg@kroah.com>]

On Tue, Jul 27, 2021 at 01:01:01PM +0200, Paolo Bonzini wrote:
> On 27/07/21 10:29, Ovidiu Panait wrote:
> > From: Sean Christopherson <seanjc@google.com>
> > 
> > commit a9545779ee9e9e103648f6f2552e73cfe808d0f4 upstream
> > 
> > Use kvm_pfn_t, a.k.a. u64, for the local 'pfn' variable when retrieving
> > a so called "remapped" hva/pfn pair.  In theory, the hva could resolve to
> > a pfn in high memory on a 32-bit kernel.
> > 
> > This bug was inadvertantly exposed by commit bd2fae8da794 ("KVM: do not
> > assume PTE is writable after follow_pfn"), which added an error PFN value
> > to the mix, causing gcc to comlain about overflowing the unsigned long.
> > 
> >    arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function ‘hva_to_pfn_remapped’:
> >    include/linux/kvm_host.h:89:30: error: conversion from ‘long long unsigned int’
> >                                    to ‘long unsigned int’ changes value from
> >                                    ‘9218868437227405314’ to ‘2’ [-Werror=overflow]
> >     89 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2)
> >        |                              ^
> > virt/kvm/kvm_main.c:1935:9: note: in expansion of macro ‘KVM_PFN_ERR_RO_FAULT’
> > 
> > Cc: stable@vger.kernel.org
> > Fixes: add6a0cd1c5b ("KVM: MMU: try to fix up page faults before giving up")
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > Message-Id: <20210208201940.1258328-1-seanjc@google.com>
> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> > Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
> > ---
> >   virt/kvm/kvm_main.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 3559eba5f502..a3d82113ae1c 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -1501,7 +1501,7 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
> >   			       bool write_fault, bool *writable,
> >   			       kvm_pfn_t *p_pfn)
> >   {
> > -	unsigned long pfn;
> > +	kvm_pfn_t pfn;
> >   	pte_t *ptep;
> >   	spinlock_t *ptl;
> >   	int r;
> > 
> 
> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
> 
> and the other two are the same as v1.

Thanks, now queued up.  I'll push out a new -rc with this added.

greg k-h