mirror of
https://github.com/torvalds/linux.git
synced 2024-11-05 03:21:32 +00:00
350b8bdd68
The third parameter of kvm_iommu_put_pages is wrong, It should be 'gfn - slot->base_gfn'. By making gfn very large, malicious guest or userspace can cause kvm to go to this error path, and subsequently to pass a huge value as size. Alternatively if gfn is small, then pages would be pinned but never unpinned, causing host memory leak and local DOS. Passing a reasonable but large value could be the most dangerous case, because it would unpin a page that should have stayed pinned, and thus allow the device to DMA into arbitrary memory. However, this cannot happen because of the condition that can trigger the error: - out of memory (where you can't allocate even a single page) should not be possible for the attacker to trigger - when exceeding the iommu's address space, guest pages after gfn will also exceed the iommu's address space, and inside kvm_iommu_put_pages() the iommu_iova_to_phys() will fail. The page thus would not be unpinned at all. Reported-by: Jack Morgenstein <jackm@mellanox.com> Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|---|---|---|
| .. | ||
| arm | ||
| assigned-dev.c | ||
| async_pf.c | ||
| async_pf.h | ||
| coalesced_mmio.c | ||
| coalesced_mmio.h | ||
| eventfd.c | ||
| ioapic.c | ||
| ioapic.h | ||
| iodev.h | ||
| iommu.c | ||
| irq_comm.c | ||
| irqchip.c | ||
| Kconfig | ||
| kvm_main.c | ||
| vfio.c | ||