On Wed, Jul 10, 2024 at 4:42 PM James Houghton <jthoughton@xxxxxxxxxx> wrote:
>
> + case KVM_READ_USERFAULT: {
> + struct kvm_fault fault;
> + gfn_t gfn;
> +
> + r = kvm_vm_ioctl_read_userfault(kvm, &gfn);
> + if (r)
> + goto out;
> +
> + fault.address = gfn;
> +
> + /* TODO: if this fails, this gfn is lost. */
> + r = -EFAULT;
> + if (copy_to_user(&fault, argp, sizeof(fault)))
You could do the copy under the spin_lock() with
copy_to_user_nofault() to avoid losing gfn.
