Quentin Casasnovas ee7b626722 kvm: fix excessive pages un-pinning in kvm_iommu_map error path. ... commit 3d32e4dbe7 upstream. The third parameter of kvm_unpin_pages() when called from kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin and not the page size. This error was facilitated with an inconsistent API: kvm_pin_pages() takes a size, but kvn_unpin_pages() takes a number of pages, so fix the problem by matching the two. This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of un-pinning for pages intended to be un-pinned (i.e. memory leak) but unfortunately potentially aggravated the number of pages we un-pin that should have stayed pinned. As far as I understand though, the same practical mitigations apply. This issue was found during review of Red Hat 6.6 patches to prepare Ksplice rebootless updates. Thanks to Vegard for his time on a late Friday evening to help me in understanding this code. Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)") Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by: Jamie Iles <jamie.iles@oracle.com> Reviewed-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li <lizefan@huawei.com>		2015-02-02 17:04:59 +08:00
..
assigned-dev.c	KVM: Convert intx_mask_lock to spin lock	2012-03-20 12:41:24 +02:00
async_pf.c	KVM: fix the race while wakeup all pv guest	2011-01-12 11:29:03 +02:00
async_pf.h	KVM: Halt vcpu if page it tries to access is swapped out	2011-01-12 11:21:39 +02:00
coalesced_mmio.c	KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio()	2014-02-22 10:32:46 -08:00
coalesced_mmio.h	KVM: Make coalesced mmio use a device per zone	2011-09-25 19:17:57 +03:00
eventfd.c	KVM: Intelligent device lookup on I/O bus	2011-09-25 19:17:59 +03:00
ioapic.c	KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)	2013-04-25 21:19:55 -07:00
ioapic.h	KVM: convert ioapic lock to spinlock	2010-05-13 01:23:55 -03:00
iodev.h	KVM: remove in_range from io devices	2009-09-10 08:33:05 +03:00
iommu.c	kvm: fix excessive pages un-pinning in kvm_iommu_map error path.	2015-02-02 17:04:59 +08:00
irq_comm.c	KVM: Fix buffer overflow in kvm_set_irq()	2014-02-20 10:45:33 -08:00
Kconfig	KVM: Halt vcpu if page it tries to access is swapped out	2011-01-12 11:21:39 +02:00
kvm_main.c	kvm: don't take vcpu mutex for obviously invalid vcpu ioctls	2015-02-02 17:04:42 +08:00