On Sat, May 30, 2020 at 12:14 PM Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > > > And none of that code verifies that the end result is a user address. > > kvm_is_error_hva() is > return addr >= PAGE_OFFSET; Ahh, that's what I missed. It won't work on other architectures, but within x86 it's fine. Linus