diff options
| author | Gleb Natapov <gleb@redhat.com> | 2013-10-01 19:58:36 +0300 |
|---|---|---|
| committer | Christoffer Dall <christoffer.dall@linaro.org> | 2014-10-02 17:18:09 +0200 |
| commit | 89c774beb24924963aa146784a149e47efb29d82 (patch) | |
| tree | 3cc34d0cf1c1a6140bdc0cd1c93820cafcc1d06c /virt/kvm/kvm_main.c | |
| parent | df50e5da2c1c65f1db1e9186112b57a8dd0b41ae (diff) | |
Fix NULL dereference in gfn_to_hva_prot()
gfn_to_memslot() can return NULL or invalid slot. We need to check slot
validity before accessing it.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
(cherry picked from commit a2ac07fe292ea41296049dfdbfeed203e2467ee7)
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Diffstat (limited to 'virt/kvm/kvm_main.c')
| -rw-r--r-- | virt/kvm/kvm_main.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 8b47fd241a61..c5bc5aef11f5 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1065,10 +1065,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva); unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable) { struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn); - if (writable) + unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false); + + if (!kvm_is_error_hva(hva) && writable) *writable = !memslot_is_readonly(slot); - return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false); + return hva; } static int kvm_read_hva(void *data, void __user *hva, int len) |