linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Arthur Borsboom <arthurborsboom@gmail.com>,
	Juergen Gross <jgross@suse.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>
Subject: [PATCH 4.4 08/20] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
Date: Tue, 31 Oct 2017 10:55:24 +0100	[thread overview]
Message-ID: <20171031095510.621807618@linuxfoundation.org> (raw)
In-Reply-To: <20171031095510.079198256@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Juergen Gross <jgross@suse.com>

commit 298d275d4d9bea3524ff4bc76678c140611d8a8d upstream.

In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/gntdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -827,6 +827,7 @@ static int gntdev_mmap(struct file *flip
 	mutex_unlock(&priv->lock);
 
 	if (use_ptemod) {
+		map->pages_vm_start = vma->vm_start;
 		err = apply_to_page_range(vma->vm_mm, vma->vm_start,
 					  vma->vm_end - vma->vm_start,
 					  find_grant_ptes, map);
@@ -864,7 +865,6 @@ static int gntdev_mmap(struct file *flip
 					    set_grant_ptes_as_special, NULL);
 		}
 #endif
-		map->pages_vm_start = vma->vm_start;
 	}
 
 	return 0;

  parent reply	other threads:[~2017-10-31  9:56 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-31  9:55 [PATCH 4.4 00/20] 4.4.96-stable review Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 01/20] workqueue: replace pool->manager_arb mutex with a flag Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 02/20] ALSA: hda/realtek - Add support for ALC236/ALC3204 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 03/20] ALSA: hda - fix headset mic problem for Dell machines with alc236 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 04/20] ceph: unlock dangling spinlock in try_flush_caps() Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 05/20] usb: xhci: Handle error condition in xhci_stop_device() Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 06/20] spi: uapi: spidev: add missing ioctl header Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 07/20] fuse: fix READDIRPLUS skipping an entry Greg Kroah-Hartman
2017-10-31  9:55 ` Greg Kroah-Hartman [this message]
2017-10-31  9:55 ` [PATCH 4.4 09/20] Input: elan_i2c - add ELAN0611 to the ACPI table Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 10/20] Input: gtco - fix potential out-of-bound access Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 11/20] assoc_array: Fix a buggy node-splitting case Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 12/20] scsi: zfcp: fix erp_action use-before-initialize in REC action trace Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 13/20] scsi: sg: Re-fix off by one in sg_fill_request_table() Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 14/20] can: sun4i: fix loopback mode Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 15/20] can: kvaser_usb: Correct return value in printout Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 16/20] can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 17/20] regulator: fan53555: fix I2C device ids Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 18/20] x86/microcode/intel: Disable late loading on model 79 Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 19/20] ecryptfs: fix dereference of NULL user_key_payload Greg Kroah-Hartman
2017-10-31  9:55 ` [PATCH 4.4 20/20] [PATCH] Revert "drm: bridge: add DT bindings for TI ths8135" Greg Kroah-Hartman
2017-10-31 17:19 ` [PATCH 4.4 00/20] 4.4.96-stable review Guenter Roeck
2017-10-31 20:04 ` Shuah Khan
2017-10-31 21:33 ` Tom Gall
2017-11-01 15:22   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171031095510.621807618@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=arthurborsboom@gmail.com \
    --cc=boris.ostrovsky@oracle.com \
    --cc=jgross@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).