diff options
| author | Nicholas Piggin <npiggin@gmail.com> | 2021-06-24 14:29:04 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-06-24 17:55:11 +0200 |
| commit | f8be156be163a052a067306417cd0ff679068c97 (patch) | |
| tree | 2f291bec641f75e1f350177da6179e8316699d71 /MAINTAINERS | |
| parent | KVM: selftests: Fix mapping length truncation in m{,un}map() (diff) | |
| download | linux-f8be156be163a052a067306417cd0ff679068c97.tar.xz linux-f8be156be163a052a067306417cd0ff679068c97.zip | |
KVM: do not allow mapping valid but non-reference-counted pages
It's possible to create a region which maps valid but non-refcounted
pages (e.g., tail pages of non-compound higher order allocations). These
host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
of APIs, which take a reference to the page, which takes it from 0 to 1.
When the reference is dropped, this will free the page incorrectly.
Fix this by only taking a reference on valid pages if it was non-zero,
which indicates it is participating in normal refcounting (and can be
released with put_page).
This addresses CVE-2021-22543.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'MAINTAINERS')
0 files changed, 0 insertions, 0 deletions