drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"

From Sean Christopherson
f5738399ed965be3ba734bd039bf96a455bb5ac0 in linux-6.1.y/6.1.54
f046923af79158361295ed4f0a588c80b9fdcc1d in mainline linux

diff --git a/sys/dev/pci/drm/i915/gvt/gtt.c b/sys/dev/pci/drm/i915/gvt/gtt.c
index b49d16e..41c2bb4 100644 (file)
--- a/sys/dev/pci/drm/i915/gvt/gtt.c
+++ b/sys/dev/pci/drm/i915/gvt/gtt.c
@@ -1188,6 +1188,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu,
        pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry));
        if (is_error_noslot_pfn(pfn))
                return -EINVAL;
+
+       if (!pfn_valid(pfn))
+               return -EINVAL;
+
        return PageTransHuge(pfn_to_page(pfn));
 }