diff options
| author |   Linus Torvalds <torvalds@linux-foundation.org> | 2018-12-19 18:27:58 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-12-19 18:27:58 -0800 |
| commit | fe112793600bb14cfd519ed148ca2f252d7b14bc (patch) | |
| tree | d52242575c5e7f156251381d9df517e5f955dd94 /virt/kvm/coalesced_mmio.c | |
| parent | Merge tag 'dma-mapping-4.20-4' of git://git.infradead.org/users/hch/dma-mapping (diff) | |
| parent | kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (diff) | |
| download | linux-dev-fe112793600bb14cfd519ed148ca2f252d7b14bc.tar.xz linux-dev-fe112793600bb14cfd519ed148ca2f252d7b14bc.zip | |
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
- One nasty use-after-free bugfix, from this merge window however
- A less nasty use-after-free that can only zero some words at the
beginning of the page, and hence is not really exploitable
- A NULL pointer dereference
- A dummy implementation of an AMD chicken bit MSR that Windows uses
for some unknown reason
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs
KVM: X86: Fix NULL deref in vcpu_scan_ioapic
KVM: Fix UAF in nested posted interrupt processing
KVM: fix unregistering coalesced mmio zone from wrong bus
Diffstat (limited to 'virt/kvm/coalesced_mmio.c')
| -rw-r--r-- | virt/kvm/coalesced_mmio.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index 3710342cf6ad..6855cce3e528 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -175,10 +175,14 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, { struct kvm_coalesced_mmio_dev *dev, *tmp; + if (zone->pio != 1 && zone->pio != 0) + return -EINVAL; + mutex_lock(&kvm->slots_lock); list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) - if (coalesced_mmio_in_range(dev, zone->addr, zone->size)) { + if (zone->pio == dev->zone.pio && + coalesced_mmio_in_range(dev, zone->addr, zone->size)) { kvm_io_bus_unregister_dev(kvm, zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev); kvm_iodevice_destructor(&dev->dev); |