Commit 3d32e4db authored by Committed by Paolo Bonzini
kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
The third parameter of kvm_unpin_pages() when called from kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin and not the page size. This error was facilitated with an inconsistent API: kvm_pin_pages() takes a size, but kvn_unpin_pages() takes a number of pages, so fix the problem by matching the two. This was introduced by commit 350b8bdd ("kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of un-pinning for pages intended to be un-pinned (i.e. memory leak) but unfortunately potentially aggravated the number of pages we un-pin that should have stayed pinned. As far as I understand though, the same practical mitigations apply. This issue was found during review of Red Hat 6.6 patches to prepare Ksplice rebootless updates. Thanks to Vegard for his time on a late Friday evening to help me in understanding this code. Fixes: 350b8bdd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)") Cc: firstname.lastname@example.org Signed-off-by: Quentin Casasnovas <email@example.com> Signed-off-by: Vegard Nossum <firstname.lastname@example.org> Signed-off-by: Jamie Iles <email@example.com> Reviewed-by: Sasha Levin <firstname.lastname@example.org> Signed-off-by: Paolo Bonzini <email@example.com>
Showing with 4 additions and 4 deletions