From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 18 Apr 2017 14:26:01 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.4.63~24
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6e9bd0aaf2fc750cf9f3a57dc8950b54914888be;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	kvm-fix-page-struct-leak-in-handle_vmon.patch
---

diff --git a/queue-4.4/kvm-fix-page-struct-leak-in-handle_vmon.patch b/queue-4.4/kvm-fix-page-struct-leak-in-handle_vmon.patch
new file mode 100644
index 00000000000..1eb14d6d594
--- /dev/null
+++ b/queue-4.4/kvm-fix-page-struct-leak-in-handle_vmon.patch
@@ -0,0 +1,48 @@
+From 06ce521af9558814b8606c0476c54497cf83a653 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 24 Jan 2017 11:56:21 +0100
+Subject: kvm: fix page struct leak in handle_vmon
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 06ce521af9558814b8606c0476c54497cf83a653 upstream.
+
+handle_vmon gets a reference on VMXON region page,
+but does not release it. Release the reference.
+
+Found by syzkaller; based on a patch by Dmitry.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[bwh: Backported to 3.16: use skip_emulated_instruction()]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6678,14 +6678,20 @@ static int nested_vmx_check_vmptr(struct
+ 		}
+ 
+ 		page = nested_get_page(vcpu, vmptr);
+-		if (page == NULL ||
+-		    *(u32 *)kmap(page) != VMCS12_REVISION) {
++		if (page == NULL) {
+ 			nested_vmx_failInvalid(vcpu);
++			skip_emulated_instruction(vcpu);
++			return 1;
++		}
++		if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+ 			kunmap(page);
++			nested_release_page_clean(page);
++			nested_vmx_failInvalid(vcpu);
+ 			skip_emulated_instruction(vcpu);
+ 			return 1;
+ 		}
+ 		kunmap(page);
++		nested_release_page_clean(page);
+ 		vmx->nested.vmxon_ptr = vmptr;
+ 		break;
+ 	case EXIT_REASON_VMCLEAR:
diff --git a/queue-4.4/series b/queue-4.4/series
index 88f8dc5a5a5..ed292f0f4dc 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -22,3 +22,4 @@ ftrace-fix-removing-of-second-function-probe.patch
 char-drop-bogus-dependency-of-devport-on-m68k.patch
 char-lack-of-bool-string-made-config_devport-always-on.patch
 revert-mips-lantiq-fix-cascaded-irq-setup.patch
+kvm-fix-page-struct-leak-in-handle_vmon.patch