Nicholas Piggin f8be156be1 KVM: do not allow mapping valid but non-reference-counted pages ...

It's possible to create a region which maps valid but non-refcounted
pages (e.g., tail pages of non-compound higher order allocations). These
host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
of APIs, which take a reference to the page, which takes it from 0 to 1.
When the reference is dropped, this will free the page incorrectly.

Fix this by only taking a reference on valid pages if it was non-zero,
which indicates it is participating in normal refcounting (and can be
released with put_page).

This addresses CVE-2021-22543.

Signed-off-by: Nicholas Piggin <[email protected]>
Tested-by: Paolo Bonzini <[email protected]>
Cc: [email protected]
Signed-off-by: Paolo Bonzini <[email protected]>

2021-06-24 11:55:11 -04:00

..

async_pf.c

mm/gup: remove task_struct pointer for all gup code

2020-08-12 10:58:04 -07:00

async_pf.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504

2019-06-19 17:09:56 +02:00

coalesced_mmio.c

KVM: Stop looking for coalesced MMIO zones if the bus is destroyed

2021-04-20 04:18:51 -04:00

coalesced_mmio.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

dirty_ring.c

KVM: x86/mmu: Use an rwlock for the x86 MMU

2021-02-04 05:27:43 -05:00

eventfd.c

kvm/eventfd: Drain events from eventfd in irqfd_wakeup()

2020-11-15 09:49:11 -05:00

irqchip.c

Merge tag 'kvm-arm-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

2019-07-11 15:14:16 +02:00

Kconfig

entry: Provide infrastructure for work before transitioning to guest mode

2020-07-24 15:03:42 +02:00

kvm_main.c

KVM: do not allow mapping valid but non-reference-counted pages

2021-06-24 11:55:11 -04:00

mmu_lock.h

KVM: x86/mmu: Use an rwlock for the x86 MMU

2021-02-04 05:27:43 -05:00

vfio.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

vfio.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00