From: jsg <jsg@openbsd.org>
Date: Tue, 19 Sep 2023 12:31:43 +0000 (+0000)
Subject: drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=39cc1c8d7c618f0d62827d80bdaa53085731d068;p=openbsd

drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page"

From Sean Christopherson
f5738399ed965be3ba734bd039bf96a455bb5ac0 in linux-6.1.y/6.1.54
f046923af79158361295ed4f0a588c80b9fdcc1d in mainline linux
---

diff --git a/sys/dev/pci/drm/i915/gvt/gtt.c b/sys/dev/pci/drm/i915/gvt/gtt.c
index b49d16e5302..41c2bb49868 100644
--- a/sys/dev/pci/drm/i915/gvt/gtt.c
+++ b/sys/dev/pci/drm/i915/gvt/gtt.c
@@ -1188,6 +1188,10 @@ static int is_2MB_gtt_possible(struct intel_vgpu *vgpu,
 	pfn = gfn_to_pfn(vgpu->vfio_device.kvm, ops->get_pfn(entry));
 	if (is_error_noslot_pfn(pfn))
 		return -EINVAL;
+
+	if (!pfn_valid(pfn))
+		return -EINVAL;
+
 	return PageTransHuge(pfn_to_page(pfn));
 }