From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Simon Gaiser <simon@invisiblethingslab.com>,
Juergen Gross <jgross@suse.com>, Jan Beulich <jbeulich@suse.com>
Subject: [PATCH 5.16 49/53] xen/9p: use alloc/free_pages_exact()
Date: Thu, 10 Mar 2022 15:09:54 +0100 [thread overview]
Message-ID: <20220310140813.243670002@linuxfoundation.org> (raw)
In-Reply-To: <20220310140811.832630727@linuxfoundation.org>
From: Juergen Gross <jgross@suse.com>
Commit 5cadd4bb1d7fc9ab201ac14620d1a478357e4ebd upstream.
Instead of __get_free_pages() and free_pages() use alloc_pages_exact()
and free_pages_exact(). This is in preparation of a change of
gnttab_end_foreign_access() which will prohibit use of high-order
pages.
By using the local variable "order" instead of ring->intf->ring_order
in the error path of xen_9pfs_front_alloc_dataring() another bug is
fixed, as the error path can be entered before ring->intf->ring_order
is being set.
By using alloc_pages_exact() the size in bytes is specified for the
allocation, which fixes another bug for the case of
order < (PAGE_SHIFT - XEN_PAGE_SHIFT).
This is part of CVE-2022-23041 / XSA-396.
Reported-by: Simon Gaiser <simon@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/9p/trans_xen.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -281,9 +281,9 @@ static void xen_9pfs_front_free(struct x
ref = priv->rings[i].intf->ref[j];
gnttab_end_foreign_access(ref, 0, 0);
}
- free_pages((unsigned long)priv->rings[i].data.in,
- priv->rings[i].intf->ring_order -
- (PAGE_SHIFT - XEN_PAGE_SHIFT));
+ free_pages_exact(priv->rings[i].data.in,
+ 1UL << (priv->rings[i].intf->ring_order +
+ XEN_PAGE_SHIFT));
}
gnttab_end_foreign_access(priv->rings[i].ref, 0, 0);
free_page((unsigned long)priv->rings[i].intf);
@@ -322,8 +322,8 @@ static int xen_9pfs_front_alloc_dataring
if (ret < 0)
goto out;
ring->ref = ret;
- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
- order - (PAGE_SHIFT - XEN_PAGE_SHIFT));
+ bytes = alloc_pages_exact(1UL << (order + XEN_PAGE_SHIFT),
+ GFP_KERNEL | __GFP_ZERO);
if (!bytes) {
ret = -ENOMEM;
goto out;
@@ -354,9 +354,7 @@ out:
if (bytes) {
for (i--; i >= 0; i--)
gnttab_end_foreign_access(ring->intf->ref[i], 0, 0);
- free_pages((unsigned long)bytes,
- ring->intf->ring_order -
- (PAGE_SHIFT - XEN_PAGE_SHIFT));
+ free_pages_exact(bytes, 1UL << (order + XEN_PAGE_SHIFT));
}
gnttab_end_foreign_access(ring->ref, 0, 0);
free_page((unsigned long)ring->intf);
next prev parent reply other threads:[~2022-03-10 14:15 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-10 14:09 [PATCH 5.16 00/53] 5.16.14-rc2 review Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 01/53] x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 02/53] x86/speculation: Add eIBRS + Retpoline options Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 03/53] Documentation/hw-vuln: Update spectre doc Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 04/53] x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 05/53] x86/speculation: Use generic retpoline by default on AMD Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 06/53] x86/speculation: Update link to AMD speculation whitepaper Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 07/53] x86/speculation: Warn about Spectre v2 LFENCE mitigation Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 08/53] x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 09/53] ARM: report Spectre v2 status through sysfs Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 10/53] ARM: early traps initialisation Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 11/53] ARM: use LOADADDR() to get load address of sections Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 12/53] ARM: Spectre-BHB workaround Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 13/53] ARM: include unprivileged BPF status in Spectre V2 reporting Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 14/53] arm64: add ID_AA64ISAR2_EL1 sys register Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 15/53] arm64: cpufeature: add HWCAP for FEAT_AFP Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 16/53] arm64: cpufeature: add HWCAP for FEAT_RPRES Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 17/53] arm64: entry.S: Add ventry overflow sanity checks Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 18/53] arm64: spectre: Rename spectre_v4_patch_fw_mitigation_conduit Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 19/53] KVM: arm64: Allow indirect vectors to be used without SPECTRE_V3A Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 20/53] arm64: entry: Make the trampoline cleanup optional Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 21/53] arm64: entry: Free up another register on kptis tramp_exit path Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 22/53] arm64: entry: Move the trampoline data page before the text page Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 23/53] arm64: entry: Allow tramp_alias to access symbols after the 4K boundary Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 24/53] arm64: entry: Dont assume tramp_vectors is the start of the vectors Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 25/53] arm64: entry: Move trampoline macros out of ifdefd section Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 26/53] arm64: entry: Make the kpti trampolines kpti sequence optional Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 27/53] arm64: entry: Allow the trampoline text to occupy multiple pages Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 28/53] arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 29/53] arm64: entry: Add vectors that have the bhb mitigation sequences Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 30/53] arm64: entry: Add macro for reading symbol addresses from the trampoline Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 31/53] arm64: Add percpu vectors for EL1 Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 32/53] arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 33/53] arm64: Mitigate spectre style branch history side channels Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 34/53] KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 35/53] arm64: Use the clearbhb instruction in mitigations Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 36/53] arm64: proton-pack: Include unprivileged eBPF status in Spectre v2 mitigation reporting Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 37/53] ARM: fix build error when BPF_SYSCALL is disabled Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 38/53] ARM: fix co-processor register typo Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 39/53] ARM: Do not use NOCROSSREFS directive with ld.lld Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 40/53] arm64: Do not include __READ_ONCE() block in assembly files Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 41/53] ARM: fix build warning in proc-v7-bugs.c Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 42/53] xen/xenbus: dont let xenbus_grant_ring() remove grants in error case Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 43/53] xen/grant-table: add gnttab_try_end_foreign_access() Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 44/53] xen/blkfront: dont use gnttab_query_foreign_access() for mapped status Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 45/53] xen/netfront: " Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 46/53] xen/scsifront: " Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 47/53] xen/gntalloc: dont use gnttab_query_foreign_access() Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 48/53] xen: remove gnttab_query_foreign_access() Greg Kroah-Hartman
2022-03-10 14:09 ` Greg Kroah-Hartman [this message]
2022-03-10 14:09 ` [PATCH 5.16 50/53] xen/pvcalls: use alloc/free_pages_exact() Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 51/53] xen/gnttab: fix gnttab_end_foreign_access() without page specified Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 52/53] xen/netfront: react properly to failing gnttab_end_foreign_access_ref() Greg Kroah-Hartman
2022-03-10 14:09 ` [PATCH 5.16 53/53] Revert "ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE" Greg Kroah-Hartman
2022-03-10 18:48 ` [PATCH 5.16 00/53] 5.16.14-rc2 review Jon Hunter
2022-03-10 19:32 ` Shuah Khan
2022-03-10 21:30 ` Justin Forbes
2022-03-10 21:53 ` Naresh Kamboju
2022-03-10 23:20 ` Ron Economos
2022-03-10 23:20 ` Florian Fainelli
2022-03-11 0:14 ` Fox Chen
2022-03-11 1:03 ` Guenter Roeck
2022-03-11 3:11 ` Zan Aziz
2022-03-11 8:14 ` Rudi Heitbaum
2022-03-11 10:55 ` Bagas Sanjaya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220310140813.243670002@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jbeulich@suse.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=simon@invisiblethingslab.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).