Since the offset is added directly to the hva from the
gfn_to_hva_cache, a negative offset could result in an out of bounds
write. The existing BUG_ON only checks for addresses beyond the end of
the gfn_to_hva_cache, not for addresses before the start of the
gfn_to_hva_cache.
Note that all current call sites have non-negative offsets.
Fixes:
|
||
---|---|---|
.. | ||
arm | ||
async_pf.c | ||
async_pf.h | ||
coalesced_mmio.c | ||
coalesced_mmio.h | ||
eventfd.c | ||
irqchip.c | ||
Kconfig | ||
kvm_main.c | ||
vfio.c | ||
vfio.h |