KVM: Mask off the address space ID in kvm_set_internal_memslot() check

kvm_set_internal_memslot() is supposed to reject memslot IDs that belong
to userspace, i.e. IDs below KVM_USER_MEM_SLOTS, but it compares the raw
"slot" field, which packs both the address space ID and the memslot ID
(as_id << 16 | id).  For any address space other than 0, the packed value
is always >= 65536, which is larger than KVM_USER_MEM_SLOTS, and so the
sanity check is a nop regardless of the actual memslot ID.

E.g. x86 sets internal memslots for every address space, including SMM,
so the check would silently accept a userspace memslot ID for the SMM
address space while rejecting the same ID for the normal address space.

Extract the memslot ID the same way kvm_vm_ioctl_set_memory_region() and
kvm_set_memory_region() do, so that the check covers all address spaces.
No in-tree caller trips the check; this only makes the sanity check
effective for all address spaces.

Fixes: 156bffdb2b49 ("KVM: Add a dedicated API for setting KVM-internal memslots")
Signed-off-by: Zeng Chi <zengchi@kylinos.cn>
Link: https://patch.msgid.link/20260827112200.866476-1-zeng_chi911@163.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions