android_kernel_samsung_msm8976/virt/kvm
Quentin Casasnovas 3ea61129fe kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
commit 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f upstream.

The third parameter of kvm_unpin_pages() when called from
kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
and not the page size.

This error was facilitated with an inconsistent API: kvm_pin_pages() takes
a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
by matching the two.

This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter
of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
un-pinning for pages intended to be un-pinned (i.e. memory leak) but
unfortunately potentially aggravated the number of pages we un-pin that
should have stayed pinned. As far as I understand though, the same
practical mitigations apply.

This issue was found during review of Red Hat 6.6 patches to prepare
Ksplice rebootless updates.

Thanks to Vegard for his time on a late Friday evening to help me in
understanding this code.

Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Jamie Iles <jamie.iles@oracle.com>
Reviewed-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-14 08:47:56 -08:00
..
assigned-dev.c KVM: Move irq routing to generic code 2013-04-26 20:27:17 +02:00
async_pf.c KVM: do not release the error page 2012-08-06 16:04:58 +03:00
async_pf.h KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
coalesced_mmio.c KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio() 2014-02-22 12:41:29 -08:00
coalesced_mmio.h KVM: Make coalesced mmio use a device per zone 2011-09-25 19:17:57 +03:00
eventfd.c KVM: Introduce CONFIG_HAVE_KVM_IRQ_ROUTING 2013-04-26 20:27:14 +02:00
ioapic.c KVM: x86: always exit on EOIs for interrupts listed in the IOAPIC redir table 2014-09-05 16:28:35 -07:00
ioapic.h KVM: Set TMR when programming ioapic entry 2013-04-16 16:32:40 -03:00
iodev.h KVM: remove in_range from io devices 2009-09-10 08:33:05 +03:00
iommu.c kvm: fix excessive pages un-pinning in kvm_iommu_map error path. 2014-11-14 08:47:56 -08:00
irq_comm.c KVM: Move irq routing setup to irqchip.c 2013-04-26 20:27:18 +02:00
irqchip.c KVM: Move irq routing setup to irqchip.c 2013-04-26 20:27:18 +02:00
Kconfig KVM: Introduce CONFIG_HAVE_KVM_IRQ_ROUTING 2013-04-26 20:27:14 +02:00
kvm_main.c kvm: don't take vcpu mutex for obviously invalid vcpu ioctls 2014-10-30 09:35:10 -07:00