Juergen Gross 92dc0e4a21 xen/gnttab: fix gnttab_end_foreign_access() without page specified ... Commit 42baefac63 upstream. gnttab_end_foreign_access() is used to free a grant reference and optionally to free the associated page. In case the grant is still in use by the other side processing is being deferred. This leads to a problem in case no page to be freed is specified by the caller: the caller doesn't know that the page is still mapped by the other side and thus should not be used for other purposes. The correct way to handle this situation is to take an additional reference to the granted page in case handling is being deferred and to drop that reference when the grant reference could be freed finally. This requires that there are no users of gnttab_end_foreign_access() left directly repurposing the granted page after the call, as this might result in clobbered data or information leaks via the not yet freed grant reference. This is part of CVE-2022-23041 / XSA-396. Reported-by: Simon Gaiser <simon@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 10:15:13 +01:00
..
arm	…
interface	xen: sync include/xen/interface/io/ring.h with Xen's newest version	2021-12-01 09:27:44 +01:00
acpi.h	…
balloon.h	Revert "xen/balloon: Mark unallocated host memory as UNUSABLE"	2018-12-17 09:24:39 +01:00
events.h	xen/events: add a new "late EOI" evtchn framework	2020-11-05 11:08:36 +01:00
features.h	…
grant_table.h	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-11 10:15:13 +01:00
hvc-console.h	…
hvm.h	…
mem-reservation.h	xen/balloon: add runtime control for scrubbing ballooned out pages	2018-09-14 08:51:10 -04:00
page.h	…
platform_pci.h	…
swiotlb-xen.h	…
tmem.h	…
xen-ops.h	CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM	2018-11-21 09:19:28 +01:00
xen.h	xen: share start flags between PV and PVH	2018-06-19 13:51:00 +02:00
xenbus.h	arm/xen: Don't probe xenbus as part of an early initcall	2021-02-23 15:00:56 +01:00
xenbus_dev.h	…