Juergen Gross 27dc69aa55 xen/gnttab: fix gnttab_end_foreign_access() without page specified ... Commit 42baefac63 upstream. gnttab_end_foreign_access() is used to free a grant reference and optionally to free the associated page. In case the grant is still in use by the other side processing is being deferred. This leads to a problem in case no page to be freed is specified by the caller: the caller doesn't know that the page is still mapped by the other side and thus should not be used for other purposes. The correct way to handle this situation is to take an additional reference to the granted page in case handling is being deferred and to drop that reference when the grant reference could be freed finally. This requires that there are no users of gnttab_end_foreign_access() left directly repurposing the granted page after the call, as this might result in clobbered data or information leaks via the not yet freed grant reference. This is part of CVE-2022-23041 / XSA-396. Reported-by: Simon Gaiser <simon@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 12:22:37 +01:00
..
events	xen/console: harden hvc_xen against event channel storms	2021-12-22 09:32:52 +01:00
xen-pciback
xenbus	xen/xenbus: don't let xenbus_grant_ring() remove grants in error case	2022-03-11 12:22:36 +01:00
xenfs
acpi.c
arm-device.c
balloon.c
biomerge.c
cpu_hotplug.c
dbgp.c
efi.c
evtchn.c
features.c
gntalloc.c	xen/gntalloc: don't use gnttab_query_foreign_access()	2022-03-11 12:22:36 +01:00
gntdev-common.h
gntdev-dmabuf.c
gntdev-dmabuf.h
gntdev.c	xen/gntdev: fix unmap notification order	2022-01-27 11:05:08 +01:00
grant-table.c	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-11 12:22:37 +01:00
Kconfig
Makefile
manage.c
mcelog.c
mem-reservation.c
pci.c
pcpu.c
platform-pci.c
privcmd-buf.c
privcmd.c
privcmd.h
pvcalls-back.c
pvcalls-front.c	xen/pvcalls: use alloc/free_pages_exact()	2022-03-11 12:22:36 +01:00
pvcalls-front.h
swiotlb-xen.c
sys-hypervisor.c
time.c
unpopulated-alloc.c
xen-acpi-pad.c
xen-acpi-processor.c
xen-balloon.c
xen-front-pgdir-shbuf.c
xen-scsiback.c
xlate_mmu.c