diff options
| author | Sean Christopherson <[email protected]> | 2023-07-28 18:35:07 -0700 |
|---|---|---|
| committer | Paolo Bonzini <[email protected]> | 2023-08-31 13:48:51 -0400 |
| commit | f046923af79158361295ed4f0a588c80b9fdcc1d (patch) | |
| tree | ff3aaa262330b4db36bd5bbd09b27011cfc18a2b | |
| parent | 52e322eda3d475614210efbc0f2793a1da9d367a (diff) | |
drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"
Check that the pfn found by gfn_to_pfn() is actually backed by "struct
page" memory prior to retrieving and dereferencing the page. KVM
supports backing guest memory with VM_PFNMAP, VM_IO, etc., and so
there is no guarantee the pfn returned by gfn_to_pfn() has an associated
"struct page".
Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
Reviewed-by: Yan Zhao <[email protected]>
Tested-by: Yongwei Ma <[email protected]>
Reviewed-by: Zhi Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 4ec85308379a..58b9b316ae46 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -1183,6 +1183,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu, pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry)); if (is_error_noslot_pfn(pfn)) return -EINVAL; + + if (!pfn_valid(pfn)) + return -EINVAL; + return PageTransHuge(pfn_to_page(pfn)); } |