KVM: do not allow mapping valid but non-reference-counted pages (CVE-2021-22543)

3 files changed, 77 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 39095a13e29c..e78492ea1397 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,8 @@
 linux (5.10.46-2) UNRELEASED; urgency=medium
 
   * swiotlb: manipulate orig_addr when tlb_addr has offset (Closes: #989778)
+  * KVM: do not allow mapping valid but non-reference-counted pages
+    (CVE-2021-22543)
 
  -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 30 Jun 2021 15:08:29 +0200
 
diff --git a/debian/patches/bugfix/all/KVM-do-not-allow-mapping-valid-but-non-reference-cou.patch b/debian/patches/bugfix/all/KVM-do-not-allow-mapping-valid-but-non-reference-cou.patch
new file mode 100644
index 000000000000..441aff9da344
--- /dev/null
+++ b/debian/patches/bugfix/all/KVM-do-not-allow-mapping-valid-but-non-reference-cou.patch
@@ -0,0 +1,74 @@
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Thu, 24 Jun 2021 08:29:04 -0400
+Subject: KVM: do not allow mapping valid but non-reference-counted pages
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=dd8ed6c9bc2224c1ace5292d01089d3feb7ebbc3
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-22543
+
+commit f8be156be163a052a067306417cd0ff679068c97 upstream.
+
+It's possible to create a region which maps valid but non-refcounted
+pages (e.g., tail pages of non-compound higher order allocations). These
+host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
+of APIs, which take a reference to the page, which takes it from 0 to 1.
+When the reference is dropped, this will free the page incorrectly.
+
+Fix this by only taking a reference on valid pages if it was non-zero,
+which indicates it is participating in normal refcounting (and can be
+released with put_page).
+
+This addresses CVE-2021-22543.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Tested-by: Paolo Bonzini <pbonzini@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ virt/kvm/kvm_main.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index f446c36f5800..1353439691cf 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1883,6 +1883,13 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
+ 	return true;
+ }
+ 
++static int kvm_try_get_pfn(kvm_pfn_t pfn)
++{
++	if (kvm_is_reserved_pfn(pfn))
++		return 1;
++	return get_page_unless_zero(pfn_to_page(pfn));
++}
++
+ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
+ 			       unsigned long addr, bool *async,
+ 			       bool write_fault, bool *writable,
+@@ -1932,13 +1939,21 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
+ 	 * Whoever called remap_pfn_range is also going to call e.g.
+ 	 * unmap_mapping_range before the underlying pages are freed,
+ 	 * causing a call to our MMU notifier.
++	 *
++	 * Certain IO or PFNMAP mappings can be backed with valid
++	 * struct pages, but be allocated without refcounting e.g.,
++	 * tail pages of non-compound higher order allocations, which
++	 * would then underflow the refcount when the caller does the
++	 * required put_page. Don't allow those pages here.
+ 	 */ 
+-	kvm_get_pfn(pfn);
++	if (!kvm_try_get_pfn(pfn))
++		r = -EFAULT;
+ 
+ out:
+ 	pte_unmap_unlock(ptep, ptl);
+ 	*p_pfn = pfn;
+-	return 0;
++
++	return r;
+ }
+ 
+ /*
+-- 
+2.32.0
+
diff --git a/debian/patches/series b/debian/patches/series
index fd30c81d8dcf..9f796e85e767 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -118,6 +118,7 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 debian/ntfs-mark-it-as-broken.patch
 bugfix/all/vfs-move-cap_convert_nscap-call-into-vfs_setxattr.patch
 bugfix/all/can-bcm-delay-release-of-struct-bcm_op-after-synchro.patch
+bugfix/all/KVM-do-not-allow-mapping-valid-but-non-reference-cou.patch
 
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch