Juergen Gross 27dc69aa55 xen/gnttab: fix gnttab_end_foreign_access() without page specified ... Commit 42baefac63 upstream. gnttab_end_foreign_access() is used to free a grant reference and optionally to free the associated page. In case the grant is still in use by the other side processing is being deferred. This leads to a problem in case no page to be freed is specified by the caller: the caller doesn't know that the page is still mapped by the other side and thus should not be used for other purposes. The correct way to handle this situation is to take an additional reference to the granted page in case handling is being deferred and to drop that reference when the grant reference could be freed finally. This requires that there are no users of gnttab_end_foreign_access() left directly repurposing the granted page after the call, as this might result in clobbered data or information leaks via the not yet freed grant reference. This is part of CVE-2022-23041 / XSA-396. Reported-by: Simon Gaiser <simon@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 12:22:37 +01:00
..
arm	xen/arm: move xen_swiotlb_detect to arm/swiotlb-xen.h	2021-05-14 15:52:05 +02:00
interface	xen: sync include/xen/interface/io/ring.h with Xen's newest version	2021-07-05 09:49:45 +02:00
acpi.h	xen: Remove support for PV ACPI cpu/memory hotplug	2021-04-23 09:31:50 +02:00
balloon.h	xen/balloon: add header guard	2020-09-04 09:59:53 +02:00
events.h	xen/console: harden hvc_xen against event channel storms	2021-12-22 09:32:52 +01:00
features.h
grant_table.h	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-11 12:22:37 +01:00
hvc-console.h
hvm.h	xen: Move xen_setup_callback_vector() definition to include/xen/hvm.h	2020-06-11 15:15:19 +02:00
mem-reservation.h	xen/balloon: add runtime control for scrubbing ballooned out pages	2018-09-14 08:51:10 -04:00
page.h	swiotlb-xen: remove XEN_PFN_PHYS	2020-08-04 07:50:43 +02:00
platform_pci.h
swiotlb-xen.h	Merge branch 'stable/for-linus-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb	2021-05-04 10:58:49 -07:00
xen-front-pgdir-shbuf.h	xen: Introduce shared buffer helpers for page directory...	2018-12-18 12:15:55 -05:00
xen-ops.h	xen/privcmd: drop "pages" parameter from xen_remap_pfn()	2021-10-05 08:20:27 +02:00
xen.h	xen: add helpers to allocate unpopulated memory	2020-09-04 10:00:01 +02:00
xenbus.h	Xen/gnttab: introduce common INVALID_GRANT_{HANDLE,REF}	2021-03-10 16:39:29 -06:00
xenbus_dev.h