Commit 298d275d authored Oct 25, 2017 by Juergen Gross Committed by Boris Ostrovsky Oct 25, 2017

xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()



In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Cc: <stable@vger.kernel.org>
Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>

parent e1043a4b

drivers/xen/gntdev.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file flip, struct vm_area_struct vma)
		mutex_unlock(&priv->lock);

		if (use_ptemod) {
		map->pages_vm_start = vma->vm_start;
		err = apply_to_page_range(vma->vm_mm, vma->vm_start,
		vma->vm_end - vma->vm_start,
		find_grant_ptes, map);
		@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file flip, struct vm_area_struct vma)
		set_grant_ptes_as_special, NULL);
		}
		#endif
		map->pages_vm_start = vma->vm_start;
		}

		return 0;

Admin message