From patchwork Fri Nov 25 08:30:34 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [3.12,121/127] KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn() X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 84034 Message-Id: To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Ard Biesheuvel , Paolo Bonzini , Jiri Slaby Date: Fri, 25 Nov 2016 09:30:34 +0100 From: Jiri Slaby List-Id: From: Ard Biesheuvel 3.12-stable review patch. If anyone has any objections, please let me know. -- 2.10.2 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html =============== commit 85c8555ff07ef09261bd50d603cd4290cff5a8cc upstream. Read-only memory ranges may be backed by the zero page, so avoid misidentifying it a a MMIO pfn. This fixes another issue I identified when testing QEMU+KVM_UEFI, where a read to an uninitialized emulated NOR flash brought in the zero page, but mapped as a read-write device region, because kvm_is_mmio_pfn() misidentifies it as a MMIO pfn due to its PG_reserved bit being set. Signed-off-by: Ard Biesheuvel Fixes: b88657674d39 ("ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping") Signed-off-by: Paolo Bonzini Signed-off-by: Jiri Slaby --- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 3351605d2608..e7a1166c3eb4 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -104,7 +104,7 @@ static bool largepages_enabled = true; bool kvm_is_mmio_pfn(pfn_t pfn) { if (pfn_valid(pfn)) - return PageReserved(pfn_to_page(pfn)); + return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn)); return true; }