Since the offset is added directly to the hva from the
gfn_to_hva_cache, a negative offset could result in an out of bounds
write. The existing BUG_ON only checks for addresses beyond the end of
the gfn_to_hva_cache, not for addresses before the start of the
gfn_to_hva_cache.
Note that all current call sites have non-negative offsets.
Fixes: 4ec6e86362 ("kvm: Introduce kvm_write_guest_offset_cached()")
Reported-by: Cfir Cohen <[email protected]>
Signed-off-by: Jim Mattson <[email protected]>
Reviewed-by: Cfir Cohen <[email protected]>
Reviewed-by: Peter Shier <[email protected]>
Reviewed-by: Krish Sadhukhan <[email protected]>
Reviewed-by: Sean Christopherson <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Jim Mattson
7a86dab8cf