20210208201940.1258328-1-seanjc@xxxxxxxxxx>
Message-ID: <164304917820132@xxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-stable: commit
X-Patchwork-Hint: ignore
This is a note to let you know that I've just added the patch titled
KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-use-kvm_pfn_t-for-local-pfn-variable-in-hva_to_pfn_remapped.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Mon Jan 24 07:28:36 PM CET 2022
From: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
Date: Mon, 24 Jan 2022 17:44:27 +0100
Subject: KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
To: stable@xxxxxxxxxxxxxxx
Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx>, Sean Christopherson <seanjc@xxxxxxxxxx>, David Stevens <stevensd@xxxxxxxxxx>
Message-ID: <Ye7Xa599VFy2WEkC@xxxxxxxxxxxxxxx>
Content-Disposition: inline
From: Sean Christopherson <seanjc@xxxxxxxxxx>
commit a9545779ee9e9e103648f6f2552e73cfe808d0f4 upstream.
Use kvm_pfn_t, a.k.a. u64, for the local 'pfn' variable when retrieving
a so called "remapped" hva/pfn pair. In theory, the hva could resolve to
a pfn in high memory on a 32-bit kernel.
This bug was inadvertantly exposed by commit bd2fae8da794 ("KVM: do not
assume PTE is writable after follow_pfn"), which added an error PFN value
to the mix, causing gcc to comlain about overflowing the unsigned long.
arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function â??hva_to_pfn_remappedâ??:
include/linux/kvm_host.h:89:30: error: conversion from â??long long unsigned intâ??
to â??long unsigned intâ?? changes value from
â??9218868437227405314â?? to â??2â?? [-Werror=overflow]
89 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2)
| ^
virt/kvm/kvm_main.c:1935:9: note: in expansion of macro â??KVM_PFN_ERR_RO_FAULTâ??
Cc: stable@xxxxxxxxxxxxxxx
Fixes: add6a0cd1c5b ("KVM: MMU: try to fix up page faults before giving up")
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
Message-Id: <20210208201940.1258328-1-seanjc@xxxxxxxxxx>
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
virt/kvm/kvm_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1518,7 +1518,7 @@ static int hva_to_pfn_remapped(struct vm
bool write_fault, bool *writable,
kvm_pfn_t *p_pfn)
{
- unsigned long pfn;
+ kvm_pfn_t pfn;
pte_t *ptep;
spinlock_t *ptl;
int r;
Patches currently in stable-queue which might be from ben@xxxxxxxxxxxxxxx are
queue-4.9/lib-timerqueue-rely-on-rbtree-semantics-for-next-timer.patch
queue-4.9/gup-document-and-work-around-cow-can-break-either-way-issue.patch
queue-4.9/fuse-fix-live-lock-in-fuse_iget.patch
queue-4.9/kvm-do-not-assume-pte-is-writable-after-follow_pfn.patch
queue-4.9/drm-ttm-nouveau-don-t-call-tt-destroy-callback-on-alloc-failure.patch
queue-4.9/gianfar-simplify-fcs-handling-and-fix-memory-leak.patch
queue-4.9/mm-add-follow_pte_pmd.patch
queue-4.9/revert-gup-document-and-work-around-cow-can-break-either-way-issue.patch
queue-4.9/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch
queue-4.9/cipso-calipso-resolve-a-number-of-problems-with-the-doi-refcounts.patch
queue-4.9/rbtree-cache-leftmost-node-internally.patch
queue-4.9/kvm-use-kvm_pfn_t-for-local-pfn-variable-in-hva_to_pfn_remapped.patch
queue-4.9/kvm-do-not-allow-mapping-valid-but-non-reference-counted-pages.patch
queue-4.9/fuse-fix-bad-inode.patch
