From ffd1b63a5860968068e943eab33383a766d30f64 Mon Sep 17 00:00:00 2001 From: Will Deacon Date: Wed, 30 Sep 2020 11:24:42 +0100 Subject: [PATCH] KVM: arm64: Ensure user_mem_abort() return value is initialised If a change in the MMU notifier sequence number forces user_mem_abort() to return early when attempting to handle a stage-2 fault, we return uninitialised stack to kvm_handle_guest_abort(), which could potentially result in the injection of an external abort into the guest or a spurious return to userspace. Neither or these are what we want to do. Initialise 'ret' to 0 in user_mem_abort() so that bailing due to a change in the MMU notrifier sequence number is treated as though the fault was handled. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier Reviewed-by: Alexandru Elisei Reviewed-by: Gavin Shan Cc: Gavin Shan Cc: Alexandru Elisei Link: https://lore.kernel.org/r/20200930102442.16142-1-will@kernel.org --- arch/arm64/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index c5c26a9cb85ba..a816cb8e619b4 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -742,7 +742,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, struct kvm_memory_slot *memslot, unsigned long hva, unsigned long fault_status) { - int ret; + int ret = 0; bool write_fault, writable, force_pte = false; bool exec_fault; bool device = false; -- 2.39.5