20210208201940.1258328-1-seanjc@xxxxxxxxxx> Message-ID: <164304917820132@xxxxxxxxx> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-stable: commit X-Patchwork-Hint: ignore This is a note to let you know that I've just added the patch titled KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: kvm-use-kvm_pfn_t-for-local-pfn-variable-in-hva_to_pfn_remapped.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Mon Jan 24 07:28:36 PM CET 2022 From: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Date: Mon, 24 Jan 2022 17:44:27 +0100 Subject: KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() To: stable@xxxxxxxxxxxxxxx Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx>, Sean Christopherson <seanjc@xxxxxxxxxx>, David Stevens <stevensd@xxxxxxxxxx> Message-ID: <Ye7Xa599VFy2WEkC@xxxxxxxxxxxxxxx> Content-Disposition: inline From: Sean Christopherson <seanjc@xxxxxxxxxx> commit a9545779ee9e9e103648f6f2552e73cfe808d0f4 upstream. Use kvm_pfn_t, a.k.a. u64, for the local 'pfn' variable when retrieving a so called "remapped" hva/pfn pair. In theory, the hva could resolve to a pfn in high memory on a 32-bit kernel. This bug was inadvertantly exposed by commit bd2fae8da794 ("KVM: do not assume PTE is writable after follow_pfn"), which added an error PFN value to the mix, causing gcc to comlain about overflowing the unsigned long. arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function â??hva_to_pfn_remappedâ??: include/linux/kvm_host.h:89:30: error: conversion from â??long long unsigned intâ?? to â??long unsigned intâ?? changes value from â??9218868437227405314â?? to â??2â?? [-Werror=overflow] 89 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2) | ^ virt/kvm/kvm_main.c:1935:9: note: in expansion of macro â??KVM_PFN_ERR_RO_FAULTâ?? Cc: stable@xxxxxxxxxxxxxxx Fixes: add6a0cd1c5b ("KVM: MMU: try to fix up page faults before giving up") Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx> Message-Id: <20210208201940.1258328-1-seanjc@xxxxxxxxxx> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1518,7 +1518,7 @@ static int hva_to_pfn_remapped(struct vm bool write_fault, bool *writable, kvm_pfn_t *p_pfn) { - unsigned long pfn; + kvm_pfn_t pfn; pte_t *ptep; spinlock_t *ptl; int r; Patches currently in stable-queue which might be from ben@xxxxxxxxxxxxxxx are queue-4.9/lib-timerqueue-rely-on-rbtree-semantics-for-next-timer.patch queue-4.9/gup-document-and-work-around-cow-can-break-either-way-issue.patch queue-4.9/fuse-fix-live-lock-in-fuse_iget.patch queue-4.9/kvm-do-not-assume-pte-is-writable-after-follow_pfn.patch queue-4.9/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-alloc-failure.patch queue-4.9/gianfar-simplify-fcs-handling-and-fix-memory-leak.patch queue-4.9/mm-add-follow_pte_pmd.patch queue-4.9/revert-gup-document-and-work-around-cow-can-break-either-way-issue.patch queue-4.9/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch queue-4.9/cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch queue-4.9/rbtree-cache-leftmost-node-internally.patch queue-4.9/kvm-use-kvm_pfn_t-for-local-pfn-variable-in-hva_to_pfn_remapped.patch queue-4.9/kvm-do-not-allow-mapping-valid-but-non-reference-counted-pages.patch queue-4.9/fuse-fix-bad-inode.patch