[Disco 05/10] KVM: Properly check if "page" is valid in kvm_vcpu_unmap

[Thadeu Lima de Souza Cascardo]

From: KarimAllah Ahmed <karahmed at amazon.de>

CVE-2019-3016
CVE-2020-3016

The field "page" is initialized to KVM_UNMAPPED_PAGE when it is not used
(i.e. when the memory lives outside kernel control). So this check will
always end up using kunmap even for memremap regions.

Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API")
Cc: stable at vger.kernel.org
Signed-off-by: KarimAllah Ahmed <karahmed at amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
(cherry picked from commit b614c6027896ff9ad6757122e84760d938cab15e)
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
---
 virt/kvm/kvm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 8d7585b99499..d40c8d70fd4e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1841,7 +1841,7 @@ void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
 	if (!map->hva)
 		return;
 
-	if (map->page)
+	if (map->page != KVM_UNMAPPED_PAGE)
 		kunmap(map->page);
 #ifdef CONFIG_HAS_IOMEM
 	else
-- 
2.24.0