Juergen Gross 27dc69aa55 xen/gnttab: fix gnttab_end_foreign_access() without page specified ... Commit 42baefac63 upstream. gnttab_end_foreign_access() is used to free a grant reference and optionally to free the associated page. In case the grant is still in use by the other side processing is being deferred. This leads to a problem in case no page to be freed is specified by the caller: the caller doesn't know that the page is still mapped by the other side and thus should not be used for other purposes. The correct way to handle this situation is to take an additional reference to the granted page in case handling is being deferred and to drop that reference when the grant reference could be freed finally. This requires that there are no users of gnttab_end_foreign_access() left directly repurposing the granted page after the call, as this might result in clobbered data or information leaks via the not yet freed grant reference. This is part of CVE-2022-23041 / XSA-396. Reported-by: Simon Gaiser <simon@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 12:22:37 +01:00
..
events	xen/console: harden hvc_xen against event channel storms	2021-12-22 09:32:52 +01:00
xen-pciback	xen-pciback: Fix return in pm_ctrl_init()	2021-11-18 19:17:05 +01:00
xenbus	xen/xenbus: don't let xenbus_grant_ring() remove grants in error case	2022-03-11 12:22:36 +01:00
xenfs
acpi.c
arm-device.c
balloon.c	xen/balloon: add late_initcall_sync() for initial ballooning done	2021-11-18 19:16:04 +01:00
biomerge.c
cpu_hotplug.c
dbgp.c
efi.c
evtchn.c
features.c	xen: check required Xen features	2021-08-30 11:57:45 +02:00
gntalloc.c	xen/gntalloc: don't use gnttab_query_foreign_access()	2022-03-11 12:22:36 +01:00
gntdev-common.h
gntdev-dmabuf.c
gntdev-dmabuf.h
gntdev.c	xen/gntdev: fix unmap notification order	2022-01-27 11:05:08 +01:00
grant-table.c	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-11 12:22:37 +01:00
Kconfig	xen/x86: allow PVH Dom0 without XEN_PV=y	2021-10-05 08:35:56 +02:00
Makefile
manage.c
mcelog.c
mem-reservation.c
pci.c
pcpu.c	xen: Use DEVICE_ATTR_*() macro	2021-07-05 09:23:31 +02:00
platform-pci.c
privcmd-buf.c
privcmd.c	xen/privcmd: drop "pages" parameter from xen_remap_pfn()	2021-10-05 08:20:27 +02:00
privcmd.h
pvcalls-back.c
pvcalls-front.c	xen/pvcalls: use alloc/free_pages_exact()	2022-03-11 12:22:36 +01:00
pvcalls-front.h
swiotlb-xen.c	xen: branch for v5.15-rc3	2021-09-25 15:37:31 -07:00
sys-hypervisor.c
time.c
unpopulated-alloc.c
xen-acpi-pad.c
xen-acpi-processor.c
xen-balloon.c	xen: Use DEVICE_ATTR_*() macro	2021-07-05 09:23:31 +02:00
xen-front-pgdir-shbuf.c
xen-scsiback.c	isystem: trim/fixup stdarg.h and other headers	2021-08-19 09:02:55 +09:00
xlate_mmu.c