diff mbox series

[Disco,05/10] KVM: Properly check if "page" is valid in kvm_vcpu_unmap

Message ID 20200131111035.38050-6-cascardo@canonical.com
State New
Headers show
Series CVE-2019-3016 | expand

Commit Message

Thadeu Lima de Souza Cascardo Jan. 31, 2020, 11:10 a.m. UTC 
From: KarimAllah Ahmed <karahmed@amazon.de>

CVE-2019-3016
CVE-2020-3016

The field "page" is initialized to KVM_UNMAPPED_PAGE when it is not used
(i.e. when the memory lives outside kernel control). So this check will
always end up using kunmap even for memremap regions.

Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API")
Cc: stable@vger.kernel.org
Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit b614c6027896ff9ad6757122e84760d938cab15e)
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
 virt/kvm/kvm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 8d7585b99499..d40c8d70fd4e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1841,7 +1841,7 @@  void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
 	if (!map->hva)
 		return;
 
-	if (map->page)
+	if (map->page != KVM_UNMAPPED_PAGE)
 		kunmap(map->page);
 #ifdef CONFIG_HAS_IOMEM
 	else