| From 298d275d4d9bea3524ff4bc76678c140611d8a8d Mon Sep 17 00:00:00 2001 |
| From: Juergen Gross <jgross@suse.com> |
| Date: Wed, 25 Oct 2017 17:08:07 +0200 |
| Subject: xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() |
| |
| From: Juergen Gross <jgross@suse.com> |
| |
| commit 298d275d4d9bea3524ff4bc76678c140611d8a8d upstream. |
| |
| In case gntdev_mmap() succeeds only partially in mapping grant pages |
| it will leave some vital information uninitialized needed later for |
| cleanup. This will lead to an out of bounds array access when unmapping |
| the already mapped pages. |
| |
| So just initialize the data needed for unmapping the pages a little bit |
| earlier. |
| |
| Reported-by: Arthur Borsboom <arthurborsboom@gmail.com> |
| Signed-off-by: Juergen Gross <jgross@suse.com> |
| Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> |
| Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/xen/gntdev.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/xen/gntdev.c |
| +++ b/drivers/xen/gntdev.c |
| @@ -1030,6 +1030,7 @@ static int gntdev_mmap(struct file *flip |
| mutex_unlock(&priv->lock); |
| |
| if (use_ptemod) { |
| + map->pages_vm_start = vma->vm_start; |
| err = apply_to_page_range(vma->vm_mm, vma->vm_start, |
| vma->vm_end - vma->vm_start, |
| find_grant_ptes, map); |
| @@ -1067,7 +1068,6 @@ static int gntdev_mmap(struct file *flip |
| set_grant_ptes_as_special, NULL); |
| } |
| #endif |
| - map->pages_vm_start = vma->vm_start; |
| } |
| |
| return 0; |
