From a79bb50808a58482eaf39d8e15fbc388cbea3a74 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Tue, 20 Oct 2026 10:02:53 -1000 Subject: [PATCH] KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd kvm_htab_read() and kvm_htab_write() check the user buffer with access_ok() once and then move each HPT entry with two __put_user() or __get_user() calls, with real work between entries. Each of those accesses opens and closes user access on its own, so the up-front check saves nothing. Use put_user() and get_user(). On powerpc the only difference is the address check: __get_user() and __put_user() already do might_fault(). kvm_htab_write() holds mmu_setup_lock across the loop, but it already reads each header with __copy_from_user() under that lock, so nothing new happens under it. The access_ok() calls stay. This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds --- arch/powerpc/kvm/book3s_64_mmu_hv.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c index 2ccb3d138f46..00b8a3f855f4 100644 --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c @@ -1749,8 +1749,8 @@ static ssize_t kvm_htab_read(struct file *file, char __user *buf, record_hpte(flags, hptp, hpte, revp, 1, first_pass)) { /* valid entry, write it out */ ++hdr.n_valid; - if (__put_user(hpte[0], lbuf) || - __put_user(hpte[1], lbuf + 1)) + if (put_user(hpte[0], lbuf) || + put_user(hpte[1], lbuf + 1)) return -EFAULT; nb += HPTE_SIZE; lbuf += 2; @@ -1853,8 +1853,8 @@ static ssize_t kvm_htab_write(struct file *file, const char __user *buf, __be64 hpte_r; err = -EFAULT; - if (__get_user(hpte_v, lbuf) || - __get_user(hpte_r, lbuf + 1)) + if (get_user(hpte_v, lbuf) || + get_user(hpte_r, lbuf + 1)) goto out; v = be64_to_cpu(hpte_v); r = be64_to_cpu(hpte_r);