From: Joerg Roedel When the PSP checks on a user-provided CPUID page fail KVM will write back the detailed error information to the user-provided buffer. Make sure this buffer is actually writable to not write the errors to a read-only page. Fixes: 2a62345b3052 ("KVM: guest_memfd: GUP source pages prior to populating guest memory") Signed-off-by: Joerg Roedel --- arch/x86/kvm/svm/sev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index dab8109edf26..5fd08d34be3f 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2415,6 +2415,7 @@ static int snp_launch_update(struct kvm *kvm, struct kvm_sev_cmd *argp) struct kvm_memory_slot *memslot; long npages, count; void __user *src; + int write; if (!sev_snp_guest(kvm) || !sev->snp_context) return -EINVAL; @@ -2475,7 +2476,10 @@ static int snp_launch_update(struct kvm *kvm, struct kvm_sev_cmd *argp) sev_populate_args.sev_fd = argp->sev_fd; sev_populate_args.type = params.type; - count = kvm_gmem_populate(kvm, params.gfn_start, src, npages, 0, + /* Acquire a write-reference for CPUID pages as kernel might write to it */ + write = params.type == KVM_SEV_SNP_PAGE_TYPE_CPUID; + + count = kvm_gmem_populate(kvm, params.gfn_start, src, npages, write, sev_gmem_post_populate, &sev_populate_args); if (count < 0) { argp->error = sev_populate_args.fw_error; -- 2.53.0