linux-stable/include/xen
Juergen Gross 42baefac63 xen/gnttab: fix gnttab_end_foreign_access() without page specified
gnttab_end_foreign_access() is used to free a grant reference and
optionally to free the associated page. In case the grant is still in
use by the other side processing is being deferred. This leads to a
problem in case no page to be freed is specified by the caller: the
caller doesn't know that the page is still mapped by the other side
and thus should not be used for other purposes.

The correct way to handle this situation is to take an additional
reference to the granted page in case handling is being deferred and
to drop that reference when the grant reference could be freed
finally.

This requires that there are no users of gnttab_end_foreign_access()
left directly repurposing the granted page after the call, as this
might result in clobbered data or information leaks via the not yet
freed grant reference.

This is part of CVE-2022-23041 / XSA-396.

Reported-by: Simon Gaiser <simon@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
V4:
- expand comment in header
V5:
- get page ref in case of kmalloc() failure, too
2022-03-07 09:48:55 +01:00
..
arm xen: allow pv-only hypercalls only with CONFIG_XEN_PV 2021-11-02 08:11:01 -05:00
interface xen: branch for v5.17-rc1 2022-01-12 16:42:00 -08:00
acpi.h xen: Remove support for PV ACPI cpu/memory hotplug 2021-04-23 09:31:50 +02:00
balloon.h xen/balloon: Bring alloc(free)_xenballooned_pages helpers back 2022-01-06 09:53:35 +01:00
events.h xen/console: harden hvc_xen against event channel storms 2021-12-16 08:24:08 +01:00
features.h
grant_table.h xen/gnttab: fix gnttab_end_foreign_access() without page specified 2022-03-07 09:48:55 +01:00
hvc-console.h
hvm.h
mem-reservation.h
page.h swiotlb-xen: remove XEN_PFN_PHYS 2020-08-04 07:50:43 +02:00
pci.h xen-pciback: allow compiling on other archs than x86 2021-11-02 08:03:43 -05:00
platform_pci.h
swiotlb-xen.h Merge branch 'stable/for-linus-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb 2021-05-04 10:58:49 -07:00
xen-front-pgdir-shbuf.h
xen-ops.h xen/privcmd: drop "pages" parameter from xen_remap_pfn() 2021-10-05 08:20:27 +02:00
xen.h xen/unpopulated-alloc: Add mechanism to use Xen resource 2022-01-06 09:53:38 +01:00
xenbus.h xen: add "not_essential" flag to struct xenbus_driver 2021-11-23 13:41:29 -06:00
xenbus_dev.h xen: xenbus_dev.h: delete incorrect file name 2022-02-03 08:16:32 +01:00