linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Arthur Borsboom <arthurborsboom@gmail.com>,
	Juergen Gross <jgross@suse.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>
Subject: [PATCH 4.13 21/43] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
Date: Tue, 31 Oct 2017 10:55:41 +0100	[thread overview]
Message-ID: <20171031095531.368956525@linuxfoundation.org> (raw)
In-Reply-To: <20171031095530.520746935@linuxfoundation.org>

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Juergen Gross <jgross@suse.com>

commit 298d275d4d9bea3524ff4bc76678c140611d8a8d upstream.

In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/gntdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip
 	mutex_unlock(&priv->lock);
 
 	if (use_ptemod) {
+		map->pages_vm_start = vma->vm_start;
 		err = apply_to_page_range(vma->vm_mm, vma->vm_start,
 					  vma->vm_end - vma->vm_start,
 					  find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip
 					    set_grant_ptes_as_special, NULL);
 		}
 #endif
-		map->pages_vm_start = vma->vm_start;
 	}
 
 	return 0;

  parent reply	other threads:[~2017-10-31  9:58 UTC|newest]

Thread overview: 71+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-31  9:55 [PATCH 4.13 00/43] 4.13.11-stable review Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 01/43] workqueue: replace pool->manager_arb mutex with a flag Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 03/43] ALSA: hda/realtek - Add support for ALC236/ALC3204 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 04/43] ALSA: hda - fix headset mic problem for Dell machines with alc236 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 05/43] ceph: unlock dangling spinlock in try_flush_caps() Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 06/43] Fix tracing sample code warning Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 07/43] KVM: PPC: Fix oops when checking KVM_CAP_PPC_HTM Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 08/43] KVM: PPC: Book3S HV: POWER9 more doorbell fixes Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 09/43] KVM: PPC: Book3S: Protect kvmppc_gpa_to_ua() with SRCU Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 10/43] s390/kvm: fix detection of guest machine checks Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 11/43] nbd: handle interrupted sendmsg with a sndtimeo set Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 12/43] spi: uapi: spidev: add missing ioctl header Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 13/43] spi: a3700: Return correct value on timeout detection Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 14/43] spi: bcm-qspi: Fix use after free in bcm_qspi_probe() in error path Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 15/43] spi: armada-3700: Fix failing commands with quad-SPI Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 16/43] ovl: add NULL check in ovl_alloc_inode Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 17/43] ovl: fix EIO from lookup of non-indexed upper Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 18/43] ovl: handle ENOENT on index lookup Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 19/43] ovl: do not cleanup unsupported index entries Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 20/43] fuse: fix READDIRPLUS skipping an entry Greg Kroah-Hartman
2017-10-31  9:55 ` Greg Kroah-Hartman [this message]
2017-10-31  9:55 ` [PATCH 4.13 22/43] xen: fix booting ballooned down hvm guest Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 23/43] cifs: Select all required crypto modules Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 25/43] Input: elan_i2c - add ELAN0611 to the ACPI table Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 26/43] Input: gtco - fix potential out-of-bound access Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 27/43] Fix encryption labels and lengths for SMB3.1.1 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 28/43] SMB3: Validate negotiate request must always be signed Greg Kroah-Hartman
2017-10-31 13:02   ` Thomas Backlund
2017-11-01 15:17     ` Greg Kroah-Hartman
2017-11-01 15:18     ` Greg Kroah-Hartman
2018-01-04  2:15       ` Srivatsa S. Bhat
2018-01-18 21:25         ` Srivatsa S. Bhat
2018-01-19 13:23           ` Aurélien Aptel
2018-01-30  3:31             ` Srivatsa S. Bhat
2018-02-27  3:44         ` Srivatsa S. Bhat
2018-02-27  8:54           ` Greg Kroah-Hartman
2018-02-27  9:22             ` Srivatsa S. Bhat
2018-02-27 12:40               ` Greg Kroah-Hartman
2018-02-27 17:45                 ` Srivatsa S. Bhat
2018-02-27 17:55                   ` Steve French
2018-02-27 17:56                   ` Steve French
2018-02-27 18:33                     ` Srivatsa S. Bhat
2018-03-12  2:37                       ` Steve French
2018-03-13  9:21                         ` Greg Kroah-Hartman
2018-03-13 15:21                           ` Steve French
2018-03-16 13:32                             ` Greg Kroah-Hartman
2018-03-16 16:19                               ` Steve French
2018-03-22  2:02                               ` Steve French
2018-03-22  5:12                                 ` Srivatsa S. Bhat
2018-03-22  5:15                                   ` Srivatsa S. Bhat
2018-03-22 10:32                                     ` Greg Kroah-Hartman
2018-03-22 19:14                                   ` Pavel Shilovsky
2018-03-01 20:12                     ` Steve French
2018-03-01 20:51                       ` Srivatsa S. Bhat
2017-10-31  9:55 ` [PATCH 4.13 29/43] assoc_array: Fix a buggy node-splitting case Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 30/43] scsi: zfcp: fix erp_action use-before-initialize in REC action trace Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 31/43] scsi: aacraid: Fix controller initialization failure Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 32/43] scsi: qla2xxx: Initialize Work element before requesting IRQs Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 33/43] scsi: sg: Re-fix off by one in sg_fill_request_table() Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 34/43] x86/cpu/AMD: Apply the Erratum 688 fix when the BIOS doesnt Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 35/43] drm/amd/powerplay: fix uninitialized variable Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 36/43] drm/i915/perf: fix perf enable/disable ioctls with 32bits userspace Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 37/43] can: sun4i: fix loopback mode Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 38/43] can: kvaser_usb: Correct return value in printout Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.13 39/43] can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages Greg Kroah-Hartman
2017-10-31  9:56 ` [PATCH 4.13 40/43] cfg80211: fix connect/disconnect edge cases Greg Kroah-Hartman
2017-10-31  9:56 ` [PATCH 4.13 41/43] ipsec: Fix aborted xfrm policy dump crash Greg Kroah-Hartman
2017-10-31  9:56 ` [PATCH 4.13 42/43] regulator: fan53555: fix I2C device ids Greg Kroah-Hartman
2017-10-31 17:20 ` [PATCH 4.13 00/43] 4.13.11-stable review Guenter Roeck
2017-11-01 15:21   ` Greg Kroah-Hartman
2017-10-31 20:04 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171031095531.368956525@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=arthurborsboom@gmail.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=jgross@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).