ACK: [Precise][CVE-2014-8369] kvm: fix excessive pages un-pinning in kvm_iommu_map error path.

[Brad Figg]

On 12/02/2014 03:26 AM, Luis Henriques wrote:
> From: Quentin Casasnovas <quentin.casasnovas at oracle.com>
> 
> The third parameter of kvm_unpin_pages() when called from
> kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
> and not the page size.
> 
> This error was facilitated with an inconsistent API: kvm_pin_pages() takes
> a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
> by matching the two.
> 
> This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter
> of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
> un-pinning for pages intended to be un-pinned (i.e. memory leak) but
> unfortunately potentially aggravated the number of pages we un-pin that
> should have stayed pinned. As far as I understand though, the same
> practical mitigations apply.
> 
> This issue was found during review of Red Hat 6.6 patches to prepare
> Ksplice rebootless updates.
> 
> Thanks to Vegard for his time on a late Friday evening to help me in
> understanding this code.
> 
> Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
> Cc: stable at vger.kernel.org
> Signed-off-by: Quentin Casasnovas <quentin.casasnovas at oracle.com>
> Signed-off-by: Vegard Nossum <vegard.nossum at oracle.com>
> Signed-off-by: Jamie Iles <jamie.iles at oracle.com>
> Reviewed-by: Sasha Levin <sasha.levin at oracle.com>
> Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
> (backported from commit 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f)
> CVE-2014-8369
> BugLink: http://bugs.launchpad.net/bugs/1386395
> Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
> ---
>  virt/kvm/iommu.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
> index c946700927fa..e32c93ca6446 100644
> --- a/virt/kvm/iommu.c
> +++ b/virt/kvm/iommu.c
> @@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
>  				gfn_t base_gfn, unsigned long npages);
>  
>  static pfn_t kvm_pin_pages(struct kvm *kvm, struct kvm_memory_slot *slot,
> -			   gfn_t gfn, unsigned long size)
> +			   gfn_t gfn, unsigned long npages)
>  {
>  	gfn_t end_gfn;
>  	pfn_t pfn;
>  
>  	pfn     = gfn_to_pfn_memslot(kvm, slot, gfn);
> -	end_gfn = gfn + (size >> PAGE_SHIFT);
> +	end_gfn = gfn + npages;
>  	gfn    += 1;
>  
>  	if (is_error_pfn(pfn))
> @@ -117,7 +117,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
>  		 * Pin all pages we are about to map in memory. This is
>  		 * important because we unmap and unpin in 4kb steps later.
>  		 */
> -		pfn = kvm_pin_pages(kvm, slot, gfn, page_size);
> +		pfn = kvm_pin_pages(kvm, slot, gfn, page_size >> PAGE_SHIFT);
>  		if (is_error_pfn(pfn)) {
>  			gfn += 1;
>  			continue;
> @@ -129,7 +129,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
>  		if (r) {
>  			printk(KERN_ERR "kvm_iommu_map_address:"
>  			       "iommu failed to map pfn=%llx\n", pfn);
> -			kvm_unpin_pages(kvm, pfn, page_size);
> +			kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT);
>  			goto unmap_pages;
>  		}
>  
> 


-- 
Brad Figg brad.figg at canonical.com http://www.canonical.com