KVM: Write the per-page "segment" when clearing (part of) a guest page

Pass "seg" instead of "len" when writing guest memory in kvm_clear_guest(),
as "seg" holds the number of bytes to write for the current page, while
"len" holds the total bytes remaining.

Luckily, all users of kvm_clear_guest() are guaranteed to not cross a page
boundary, and so the bug is unhittable in the current code base.

Fixes: 2f5414423ef5 ("KVM: remove kvm_clear_guest_page")
Reported-by: zyr_ms@outlook.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219104
Link: https://lore.kernel.org/r/20240829191413.900740-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index cb2b78e92910fb1d6ebed0b73cf359e866f0a06b..04011b94edece64b081d01b534be94078b19f8c9 100644 (file)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3581,7 +3581,7 @@ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
        int ret;
 
        while ((seg = next_segment(len, offset)) != 0) {
-               ret = kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
+               ret = kvm_write_guest_page(kvm, gfn, zero_page, offset, seg);
                if (ret < 0)
                        return ret;
                offset = 0;