Re: [Xen-devel] [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

2017-10-26 Thread Boris Ostrovsky 
On 10/25/2017 12:46 PM, Boris Ostrovsky wrote:
> On 10/25/2017 11:08 AM, Juergen Gross wrote:
>> In case gntdev_mmap() succeeds only partially in mapping grant pages
>> it will leave some vital information uninitialized needed later for
>> cleanup. This will lead to an out of bounds array access when unmapping
>> the already mapped pages.
>>
>> So just initialize the data needed for unmapping the pages a little bit
>> earlier.
>>
>> Cc: 
>> Reported-by: Arthur Borsboom 
>> Signed-off-by: Juergen Gross 
> Reviewed-by: Boris Ostrovsky 
>


Applied to for-linus-4.14c.

-boris

___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

Re: [Xen-devel] [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

2017-10-25 Thread Boris Ostrovsky 
On 10/25/2017 11:08 AM, Juergen Gross wrote:
> In case gntdev_mmap() succeeds only partially in mapping grant pages
> it will leave some vital information uninitialized needed later for
> cleanup. This will lead to an out of bounds array access when unmapping
> the already mapped pages.
>
> So just initialize the data needed for unmapping the pages a little bit
> earlier.
>
> Cc: 
> Reported-by: Arthur Borsboom 
> Signed-off-by: Juergen Gross 

Reviewed-by: Boris Ostrovsky 


___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

[Xen-devel] [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

2017-10-25 Thread Juergen Gross 
In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Cc: 
Reported-by: Arthur Borsboom 
Signed-off-by: Juergen Gross 
---
 drivers/xen/gntdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 82360594fa8e..57efbd3b053b 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip, struct 
vm_area_struct *vma)
mutex_unlock(>lock);
 
if (use_ptemod) {
+   map->pages_vm_start = vma->vm_start;
err = apply_to_page_range(vma->vm_mm, vma->vm_start,
  vma->vm_end - vma->vm_start,
  find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip, struct 
vm_area_struct *vma)
set_grant_ptes_as_special, NULL);
}
 #endif
-   map->pages_vm_start = vma->vm_start;
}
 
return 0;
-- 
2.12.3


___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel