Skip to content

Commit 3d32e4d

Browse files
Quentin Casasnovasbonzini
Quentin Casasnovas
authored andcommitted
kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
The third parameter of kvm_unpin_pages() when called from kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin and not the page size. This error was facilitated with an inconsistent API: kvm_pin_pages() takes a size, but kvn_unpin_pages() takes a number of pages, so fix the problem by matching the two. This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of un-pinning for pages intended to be un-pinned (i.e. memory leak) but unfortunately potentially aggravated the number of pages we un-pin that should have stayed pinned. As far as I understand though, the same practical mitigations apply. This issue was found during review of Red Hat 6.6 patches to prepare Ksplice rebootless updates. Thanks to Vegard for his time on a late Friday evening to help me in understanding this code. Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)") Cc: stable@vger.kernel.org Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by: Jamie Iles <jamie.iles@oracle.com> Reviewed-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 3f6f148 commit 3d32e4d

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

Diff for: virt/kvm/iommu.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
4343
gfn_t base_gfn, unsigned long npages);
4444

4545
static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn,
46-
unsigned long size)
46+
unsigned long npages)
4747
{
4848
gfn_t end_gfn;
4949
pfn_t pfn;
5050

5151
pfn = gfn_to_pfn_memslot(slot, gfn);
52-
end_gfn = gfn + (size >> PAGE_SHIFT);
52+
end_gfn = gfn + npages;
5353
gfn += 1;
5454

5555
if (is_error_noslot_pfn(pfn))
@@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
119119
* Pin all pages we are about to map in memory. This is
120120
* important because we unmap and unpin in 4kb steps later.
121121
*/
122-
pfn = kvm_pin_pages(slot, gfn, page_size);
122+
pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT);
123123
if (is_error_noslot_pfn(pfn)) {
124124
gfn += 1;
125125
continue;
@@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
131131
if (r) {
132132
printk(KERN_ERR "kvm_iommu_map_address:"
133133
"iommu failed to map pfn=%llx\n", pfn);
134-
kvm_unpin_pages(kvm, pfn, page_size);
134+
kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT);
135135
goto unmap_pages;
136136
}
137137

0 commit comments

Comments
 (0)