Vulnerability: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.
Vulnerability ID: CVE-2014-8369
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2014-11-10
File: virt/kvm/iommu.c
Commit message: kvm: fix excessive pages un-pinning in kvm_iommu_map error path.

The third parameter of kvm_unpin_pages() when called from
kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
and not the page size.

This error was facilitated with an inconsistent API: kvm_pin_pages() takes
a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
by matching the two.

This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter
of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
un-pinning for pages intended to be un-pinned (i.e. memory leak) but
unfortunately potentially aggravated the number of pages we un-pin that
should have stayed pinned. As far as I understand though, the same
practical mitigations apply.

This issue was found during review of Red Hat 6.6 patches to prepare
Ksplice rebootless updates.

Thanks to Vegard for his time on a late Friday evening to help me in
understanding this code.

Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
Cc: stable@vger.kernel.org
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Jamie Iles <jamie.iles@oracle.com>
Reviewed-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Quentin Casasnovas

Vulnerable version (before fix):
 static void kvm_iommu_put_pages(struct kvm *kvm, 				gfn_t base_gfn, unsigned long npages);  static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, 			   unsigned long size) { 	gfn_t end_gfn; 	pfn_t pfn;  	pfn     = gfn_to_pfn_memslot(slot, gfn); 	end_gfn = gfn + (size >> PAGE_SHIFT); 	gfn    += 1;  	if (is_error_noslot_pfn(pfn)) int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) 		 * Pin all pages we are about to map in memory. This is 		 * important because we unmap and unpin in 4kb steps later. 		 */ 		pfn = kvm_pin_pages(slot, gfn, page_size); 		if (is_error_noslot_pfn(pfn)) { 			gfn += 1; 			continue; int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) 		if (r) { 			printk(KERN_ERR "kvm_iommu_map_address:" 			       "iommu failed to map pfn=%llx\n", pfn); 			kvm_unpin_pages(kvm, pfn, page_size); 			goto unmap_pages; 		} 

Fixed version (after fix):
 static void kvm_iommu_put_pages(struct kvm *kvm, 				gfn_t base_gfn, unsigned long npages);  static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn, 			   unsigned long npages) { 	gfn_t end_gfn; 	pfn_t pfn;  	pfn     = gfn_to_pfn_memslot(slot, gfn); 	end_gfn = gfn + npages; 	gfn    += 1;  	if (is_error_noslot_pfn(pfn)) int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) 		 * Pin all pages we are about to map in memory. This is 		 * important because we unmap and unpin in 4kb steps later. 		 */ 		pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT); 		if (is_error_noslot_pfn(pfn)) { 			gfn += 1; 			continue; int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot) 		if (r) { 			printk(KERN_ERR "kvm_iommu_map_address:" 			       "iommu failed to map pfn=%llx\n", pfn); 			kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT); 			goto unmap_pages; 		} 

Patch:
patch: @@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
 				gfn_t base_gfn, unsigned long npages);
 
 static pfn_t kvm_pin_pages(struct kvm_memory_slot *slot, gfn_t gfn,
-			   unsigned long size)
+			   unsigned long npages)
 {
 	gfn_t end_gfn;
 	pfn_t pfn;
 
 	pfn     = gfn_to_pfn_memslot(slot, gfn);
-	end_gfn = gfn + (size >> PAGE_SHIFT);
+	end_gfn = gfn + npages;
 	gfn    += 1;
 
 	if (is_error_noslot_pfn(pfn))
@@ -119,7 +119,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
 		 * Pin all pages we are about to map in memory. This is
 		 * important because we unmap and unpin in 4kb steps later.
 		 */
-		pfn = kvm_pin_pages(slot, gfn, page_size);
+		pfn = kvm_pin_pages(slot, gfn, page_size >> PAGE_SHIFT);
 		if (is_error_noslot_pfn(pfn)) {
 			gfn += 1;
 			continue;
@@ -131,7 +131,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
 		if (r) {
 			printk(KERN_ERR "kvm_iommu_map_address:"
 			       "iommu failed to map pfn=%llx\n", pfn);
-			kvm_unpin_pages(kvm, pfn, page_size);
+			kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT);
 			goto unmap_pages;
 		}
path: virt/kvm/iommu.c