mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-23 17:30:02 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/9p
History
Juergen Gross 22fd4f3fc1 xen/9p: use alloc/free_pages_exact() 
Commit 5cadd4bb1d upstream.

Instead of __get_free_pages() and free_pages() use alloc_pages_exact()
and free_pages_exact(). This is in preparation of a change of
gnttab_end_foreign_access() which will prohibit use of high-order
pages.

By using the local variable "order" instead of ring->intf->ring_order
in the error path of xen_9pfs_front_alloc_dataring() another bug is
fixed, as the error path can be entered before ring->intf->ring_order
is being set.

By using alloc_pages_exact() the size in bytes is specified for the
allocation, which fixes another bug for the case of
order < (PAGE_SHIFT - XEN_PAGE_SHIFT).

This is part of CVE-2022-23041 / XSA-396.

Reported-by: Simon Gaiser <simon@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-11 10:13:33 +01:00
..
client.c 9p/net: fix memory leak in p9_client_create 2019-03-23 14:35:09 +01:00
error.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
Kconfig xen/9pfs: select CONFIG_XEN_XENBUS_FRONTEND 2017-05-02 11:14:36 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mod.c
protocol.c 9p: p9dirent_read: check network-provided name length 2019-07-03 13:15:58 +02:00
protocol.h
trans_common.c net/9p: include trans_common.h to fix missing prototype warning. 2019-07-03 13:15:59 +02:00
trans_common.h net/9p: remove (now-)unused helpers 2015-04-11 22:28:29 -04:00
trans_fd.c net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid 2020-11-05 11:06:57 +01:00
trans_rdma.c 9p/rdma: remove useless check in cm_event_handler 2019-07-03 13:15:58 +02:00
trans_virtio.c 9p/trans_virtio: Remove sysfs file on probe failure 2021-09-26 13:37:28 +02:00
trans_xen.c xen/9p: use alloc/free_pages_exact() 2022-03-11 10:13:33 +01:00
util.c net/9p: convert to idr_alloc() 2013-02-27 19:10:20 -08:00