Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2ac07fe authored by Gleb Natapov's avatar Gleb Natapov
Browse files

Fix NULL dereference in gfn_to_hva_prot() 



gfn_to_memslot() can return NULL or invalid slot. We need to check slot
validity before accessing it.

Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
parent 517bf8fc

virt/kvm/kvm_main.c

+4 −2
Original line number Diff line number Diff line
@@ -1064,10 +1064,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva); 
unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)

{

	struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);

	if (writable)

	unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);



	if (!kvm_is_error_hva(hva) && writable)

		*writable = !memslot_is_readonly(slot);



	return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false);

	return hva;

}



static int kvm_read_hva(void *data, void __user *hva, int len)