* [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
@ 2017-10-25 15:08 Juergen Gross
2017-10-25 16:46 ` Boris Ostrovsky
2017-10-25 16:46 ` Boris Ostrovsky
0 siblings, 2 replies; 6+ messages in thread
From: Juergen Gross @ 2017-10-25 15:08 UTC (permalink / raw)
To: linux-kernel, xen-devel; +Cc: boris.ostrovsky, Juergen Gross, stable
In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.
So just initialize the data needed for unmapping the pages a little bit
earlier.
Cc: <stable@vger.kernel.org>
Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
---
drivers/xen/gntdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 82360594fa8e..57efbd3b053b 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
mutex_unlock(&priv->lock);
if (use_ptemod) {
+ map->pages_vm_start = vma->vm_start;
err = apply_to_page_range(vma->vm_mm, vma->vm_start,
vma->vm_end - vma->vm_start,
find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
set_grant_ptes_as_special, NULL);
}
#endif
- map->pages_vm_start = vma->vm_start;
}
return 0;
--
2.12.3
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
2017-10-25 15:08 [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() Juergen Gross
2017-10-25 16:46 ` Boris Ostrovsky
@ 2017-10-25 16:46 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
1 sibling, 2 replies; 6+ messages in thread
From: Boris Ostrovsky @ 2017-10-25 16:46 UTC (permalink / raw)
To: Juergen Gross, linux-kernel, xen-devel; +Cc: stable
On 10/25/2017 11:08 AM, Juergen Gross wrote:
> In case gntdev_mmap() succeeds only partially in mapping grant pages
> it will leave some vital information uninitialized needed later for
> cleanup. This will lead to an out of bounds array access when unmapping
> the already mapped pages.
>
> So just initialize the data needed for unmapping the pages a little bit
> earlier.
>
> Cc: <stable@vger.kernel.org>
> Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
> Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
2017-10-25 15:08 [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() Juergen Gross
@ 2017-10-25 16:46 ` Boris Ostrovsky
2017-10-25 16:46 ` Boris Ostrovsky
1 sibling, 0 replies; 6+ messages in thread
From: Boris Ostrovsky @ 2017-10-25 16:46 UTC (permalink / raw)
To: Juergen Gross, linux-kernel, xen-devel; +Cc: stable
On 10/25/2017 11:08 AM, Juergen Gross wrote:
> In case gntdev_mmap() succeeds only partially in mapping grant pages
> it will leave some vital information uninitialized needed later for
> cleanup. This will lead to an out of bounds array access when unmapping
> the already mapped pages.
>
> So just initialize the data needed for unmapping the pages a little bit
> earlier.
>
> Cc: <stable@vger.kernel.org>
> Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
> Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
2017-10-25 16:46 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
@ 2017-10-26 22:54 ` Boris Ostrovsky
1 sibling, 0 replies; 6+ messages in thread
From: Boris Ostrovsky @ 2017-10-26 22:54 UTC (permalink / raw)
To: Juergen Gross, linux-kernel, xen-devel; +Cc: stable
On 10/25/2017 12:46 PM, Boris Ostrovsky wrote:
> On 10/25/2017 11:08 AM, Juergen Gross wrote:
>> In case gntdev_mmap() succeeds only partially in mapping grant pages
>> it will leave some vital information uninitialized needed later for
>> cleanup. This will lead to an out of bounds array access when unmapping
>> the already mapped pages.
>>
>> So just initialize the data needed for unmapping the pages a little bit
>> earlier.
>>
>> Cc: <stable@vger.kernel.org>
>> Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
>> Signed-off-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>
Applied to for-linus-4.14c.
-boris
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
2017-10-25 16:46 ` Boris Ostrovsky
@ 2017-10-26 22:54 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
1 sibling, 0 replies; 6+ messages in thread
From: Boris Ostrovsky @ 2017-10-26 22:54 UTC (permalink / raw)
To: Juergen Gross, linux-kernel, xen-devel; +Cc: stable
On 10/25/2017 12:46 PM, Boris Ostrovsky wrote:
> On 10/25/2017 11:08 AM, Juergen Gross wrote:
>> In case gntdev_mmap() succeeds only partially in mapping grant pages
>> it will leave some vital information uninitialized needed later for
>> cleanup. This will lead to an out of bounds array access when unmapping
>> the already mapped pages.
>>
>> So just initialize the data needed for unmapping the pages a little bit
>> earlier.
>>
>> Cc: <stable@vger.kernel.org>
>> Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
>> Signed-off-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>
Applied to for-linus-4.14c.
-boris
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
@ 2017-10-25 15:08 Juergen Gross
0 siblings, 0 replies; 6+ messages in thread
From: Juergen Gross @ 2017-10-25 15:08 UTC (permalink / raw)
To: linux-kernel, xen-devel; +Cc: Juergen Gross, boris.ostrovsky, stable
In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.
So just initialize the data needed for unmapping the pages a little bit
earlier.
Cc: <stable@vger.kernel.org>
Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
---
drivers/xen/gntdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 82360594fa8e..57efbd3b053b 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
mutex_unlock(&priv->lock);
if (use_ptemod) {
+ map->pages_vm_start = vma->vm_start;
err = apply_to_page_range(vma->vm_mm, vma->vm_start,
vma->vm_end - vma->vm_start,
find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
set_grant_ptes_as_special, NULL);
}
#endif
- map->pages_vm_start = vma->vm_start;
}
return 0;
--
2.12.3
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-10-26 22:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-25 15:08 [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() Juergen Gross
2017-10-25 16:46 ` Boris Ostrovsky
2017-10-25 16:46 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
2017-10-26 22:54 ` Boris Ostrovsky
2017-10-25 15:08 Juergen Gross
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.