Quentin Casasnovas 3d32e4dbe7 kvm: fix excessive pages un-pinning in kvm_iommu_map error path. ... The third parameter of kvm_unpin_pages() when called from kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin and not the page size. This error was facilitated with an inconsistent API: kvm_pin_pages() takes a size, but kvn_unpin_pages() takes a number of pages, so fix the problem by matching the two. This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of un-pinning for pages intended to be un-pinned (i.e. memory leak) but unfortunately potentially aggravated the number of pages we un-pin that should have stayed pinned. As far as I understand though, the same practical mitigations apply. This issue was found during review of Red Hat 6.6 patches to prepare Ksplice rebootless updates. Thanks to Vegard for his time on a late Friday evening to help me in understanding this code. Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)") Cc: stable@vger.kernel.org Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by: Jamie Iles <jamie.iles@oracle.com> Reviewed-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2014-10-24 13:30:37 +02:00
..
arm	arm/arm64: KVM: Fix BE accesses to GICv2 EISR and ELRSR regs	2014-10-16 10:57:41 +02:00
assigned-dev.c	KVM: Use PCI device flag helper functions	2014-09-16 16:18:40 -06:00
async_pf.c	kvm: Faults which trigger IO release the mmap_sem	2014-09-24 14:07:54 +02:00
async_pf.h
coalesced_mmio.c	KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio()	2014-01-30 11:56:09 +01:00
coalesced_mmio.h
eventfd.c	KVM: EVENTFD: Remove inclusion of irq.h	2014-09-24 12:06:25 +02:00
ioapic.c	kvm: ioapic: conditionally delay irq delivery duringeoi broadcast	2014-09-16 14:44:48 +02:00
ioapic.h	kvm: ioapic: conditionally delay irq delivery duringeoi broadcast	2014-09-16 14:44:48 +02:00
iodev.h
iommu.c	kvm: fix excessive pages un-pinning in kvm_iommu_map error path.	2014-10-24 13:30:37 +02:00
irq_comm.c	KVM: Move all accesses to kvm::irq_routing into irqchip.c	2014-08-05 14:26:20 +02:00
irqchip.c	KVM: Move irq notifier implementation into eventfd.c	2014-08-05 14:26:24 +02:00
Kconfig	KVM: Give IRQFD its own separate enabling Kconfig option	2014-08-05 14:26:28 +02:00
kvm_main.c	Fixes and features for 3.18.	2014-10-08 05:27:39 -04:00
vfio.c	kvm-vfio: do not use module_init	2014-09-24 14:06:36 +02:00
vfio.h	kvm-vfio: do not use module_init	2014-09-24 14:06:36 +02:00