Juergen Gross 782e5ebcc8 xen/gnttab: fix gnttab_end_foreign_access() without page specified ... Commit 42baefac63 upstream. gnttab_end_foreign_access() is used to free a grant reference and optionally to free the associated page. In case the grant is still in use by the other side processing is being deferred. This leads to a problem in case no page to be freed is specified by the caller: the caller doesn't know that the page is still mapped by the other side and thus should not be used for other purposes. The correct way to handle this situation is to take an additional reference to the granted page in case handling is being deferred and to drop that reference when the grant reference could be freed finally. This requires that there are no users of gnttab_end_foreign_access() left directly repurposing the granted page after the call, as this might result in clobbered data or information leaks via the not yet freed grant reference. This is part of CVE-2022-23041 / XSA-396. Reported-by: Simon Gaiser <simon@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 11:22:39 +01:00
..
arm	swiotlb-xen: simplify cache maintainance	2019-09-11 12:43:27 +02:00
interface	xen: sync include/xen/interface/io/ring.h with Xen's newest version	2021-12-01 09:23:35 +01:00
acpi.h
balloon.h	xen: remove tmem driver	2019-07-17 08:09:58 +02:00
events.h	xen/events: add a new "late EOI" evtchn framework	2020-11-05 11:43:10 +01:00
features.h
grant_table.h	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-11 11:22:39 +01:00
hvc-console.h
hvm.h
mem-reservation.h
page.h
platform_pci.h
swiotlb-xen.h	swiotlb-xen: simplify cache maintainance	2019-09-11 12:43:27 +02:00
xen-front-pgdir-shbuf.h	xen: Introduce shared buffer helpers for page directory...	2018-12-18 12:15:55 -05:00
xen-ops.h	xen/efi: have a common runtime setup function	2019-10-02 10:31:07 -04:00
xen.h	block: pass page to xen_biovec_phys_mergeable	2019-04-01 12:11:13 -06:00
xenbus.h	arm/xen: Don't probe xenbus as part of an early initcall	2021-02-17 10:35:14 +01:00
xenbus_dev.h