User space must not map guest memory that covers the default APIC base address (0xfee00000) when using an in-kernel irqchip. Currently, KVM_SET_USER_MEMORY_REGION does not check for this. The violation goes unnoticed until vcpu creation, which fails with the misleading error -EEXIST. Add an explicit check to kvm_arch_prepare_memory_region() so the conflict is reported at the point where it is introduced. Signed-off-by: Tim Wiederhake --- arch/x86/kvm/x86.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 07f348232a72..b38d4355137a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -13684,12 +13684,19 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, return -EINVAL; if (change == KVM_MR_CREATE || change == KVM_MR_MOVE) { + const gfn_t apic_gfn = gpa_to_gfn(APIC_DEFAULT_PHYS_BASE); + if ((new->base_gfn + new->npages - 1) > kvm_mmu_max_gfn()) return -EINVAL; if (kvm_is_gfn_alias(kvm, new->base_gfn + new->npages - 1)) return -EINVAL; + if (irqchip_in_kernel(kvm) && + new->base_gfn <= apic_gfn && + apic_gfn < new->base_gfn + new->npages) + return -EEXIST; + return kvm_alloc_memslot_metadata(kvm, new); } -- 2.52.0