diff options
| author | Gleb Natapov <gleb@redhat.com> | 2013-10-01 19:58:36 +0300 |
|---|---|---|
| committer | Gleb Natapov <gleb@redhat.com> | 2013-10-03 10:08:52 +0300 |
| commit | a2ac07fe292ea41296049dfdbfeed203e2467ee7 (patch) | |
| tree | 93f6f81ef917245073ffdbc89123dd74cd8ccdd4 /virt/kvm | |
| parent | 517bf8fc211d37d3aa005fb35f9ee7f1d35cb860 (diff) | |
| download | lwn-a2ac07fe292ea41296049dfdbfeed203e2467ee7.tar.gz lwn-a2ac07fe292ea41296049dfdbfeed203e2467ee7.zip | |
Fix NULL dereference in gfn_to_hva_prot()
gfn_to_memslot() can return NULL or invalid slot. We need to check slot
validity before accessing it.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Diffstat (limited to 'virt/kvm')
| -rw-r--r-- | virt/kvm/kvm_main.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 979bff485fb0..a9dd682cf5e3 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1064,10 +1064,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva); unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable) { struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn); - if (writable) + unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false); + + if (!kvm_is_error_hva(hva) && writable) *writable = !memslot_is_readonly(slot); - return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false); + return hva; } static int kvm_read_hva(void *data, void __user *hva, int len) |