Juergen Gross 66cb2bbb52 xen/xenbus: don't let xenbus_grant_ring() remove grants in error case ... Commit 3777ea7bac upstream. Letting xenbus_grant_ring() tear down grants in the error case is problematic, as the other side could already have used these grants. Calling gnttab_end_foreign_access_ref() without checking success is resulting in an unclear situation for any caller of xenbus_grant_ring() as in the error case the memory pages of the ring page might be partially mapped. Freeing them would risk unwanted foreign access to them, while not freeing them would leak memory. In order to remove the need to undo any gnttab_grant_foreign_access() calls, use gnttab_alloc_grant_references() to make sure no further error can occur in the loop granting access to the ring pages. It should be noted that this way of handling removes leaking of grant entries in the error case, too. This is CVE-2022-23040 / part of XSA-396. Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-11 12:22:36 +01:00
..
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xenbus.h	bus: Make remove callback return void	2021-07-21 11:53:42 +02:00
xenbus_client.c	xen/xenbus: don't let xenbus_grant_ring() remove grants in error case	2022-03-11 12:22:36 +01:00
xenbus_comms.c	xen: Fix event channel callback via INTX/GSI	2021-01-13 16:12:00 +01:00
xenbus_dev_backend.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xenbus_dev_frontend.c	xen/xenbus: fix self-deadlock after killing user process	2019-10-02 16:40:11 -04:00
xenbus_probe.c	xen: detect uninitialized xenbus in xenbus_init	2021-12-01 09:04:42 +01:00
xenbus_probe_backend.c	xenbus/xenbus_backend: Disallow pending watch messages	2020-12-14 10:08:40 +01:00
xenbus_probe_frontend.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
xenbus_xs.c	xen/xenbus: Count pending messages for each watch	2020-12-14 10:07:13 +01:00