• Quentin Casasnovas's avatar
    kvm: fix excessive pages un-pinning in kvm_iommu_map error path. · 3d32e4db
    Quentin Casasnovas authored
    The third parameter of kvm_unpin_pages() when called from
    kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
    and not the page size.
    
    This error was facilitated with an inconsistent API: kvm_pin_pages() takes
    a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
    by matching the two.
    
    This was introduced by commit 350b8bdd ("kvm: iommu: fix the third parameter
    of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
    un-pinning for pages intended to be un-pinned (i.e. memory leak) but
    unfortunately potentially aggravated the number of pages we un-pin that
    should have stayed pinned. As far as I understand though, the same
    practical mitigations apply.
    
    This issue was found during review of Red Hat 6.6 patches to prepare
    Ksplice rebootless updates.
    
    Thanks to Vegard for his time on a late Friday evening to help me in
    understanding this code.
    
    Fixes: 350b8bdd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarQuentin Casasnovas <quentin.casasnovas@oracle.com>
    Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: default avatarJamie Iles <jamie.iles@oracle.com>
    Reviewed-by: default avatarSasha Levin <sasha.levin@oracle.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    3d32e4db
iommu.c 8.25 KB