From patchwork Fri Nov 25 08:25:12 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 84031 Delivered-To: patch@linaro.org Received: by 10.140.20.101 with SMTP id 92csp29335qgi; Fri, 25 Nov 2016 00:26:14 -0800 (PST) X-Received: by 10.99.101.65 with SMTP id z62mr12112470pgb.74.1480062374010; Fri, 25 Nov 2016 00:26:14 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q127si23112729pfb.189.2016.11.25.00.26.13; Fri, 25 Nov 2016 00:26:14 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750776AbcKYI0M (ORCPT + 3 others); Fri, 25 Nov 2016 03:26:12 -0500 Received: from mx2.suse.de ([195.135.220.15]:44894 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750734AbcKYI0L (ORCPT ); Fri, 25 Nov 2016 03:26:11 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id E38EDAE05; Fri, 25 Nov 2016 08:25:21 +0000 (UTC) From: Jiri Slaby To: stable@vger.kernel.org Cc: Ard Biesheuvel , Paolo Bonzini , Jiri Slaby Subject: [patch added to 3.12-stable] KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn() Date: Fri, 25 Nov 2016 09:25:12 +0100 Message-Id: <20161125082518.26936-4-jslaby@suse.cz> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20161125082518.26936-1-jslaby@suse.cz> References: <20161125082518.26936-1-jslaby@suse.cz> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ard Biesheuvel This patch has been added to the 3.12 stable tree. If you have any objections, please let us know. -- 2.10.2 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html =============== commit 85c8555ff07ef09261bd50d603cd4290cff5a8cc upstream. Read-only memory ranges may be backed by the zero page, so avoid misidentifying it a a MMIO pfn. This fixes another issue I identified when testing QEMU+KVM_UEFI, where a read to an uninitialized emulated NOR flash brought in the zero page, but mapped as a read-write device region, because kvm_is_mmio_pfn() misidentifies it as a MMIO pfn due to its PG_reserved bit being set. Signed-off-by: Ard Biesheuvel Fixes: b88657674d39 ("ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping") Signed-off-by: Paolo Bonzini Signed-off-by: Jiri Slaby --- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 3351605d2608..e7a1166c3eb4 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -104,7 +104,7 @@ static bool largepages_enabled = true; bool kvm_is_mmio_pfn(pfn_t pfn) { if (pfn_valid(pfn)) - return PageReserved(pfn_to_page(pfn)); + return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn)); return true; }