Patch "xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()" has been added to the 4.13-stable tree

Patch "xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()" has been added to the 4.13-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

to the 4.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xen-gntdev-avoid-out-of-bounds-access-in-case-of-partial-gntdev_mmap.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 298d275d4d9bea3524ff4bc76678c140611d8a8d Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Wed, 25 Oct 2017 17:08:07 +0200
Subject: xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

From: Juergen Gross <jgross@suse.com>

commit 298d275d4d9bea3524ff4bc76678c140611d8a8d upstream.

In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/gntdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip
 	mutex_unlock(&priv->lock);
 
 	if (use_ptemod) {
+		map->pages_vm_start = vma->vm_start;
 		err = apply_to_page_range(vma->vm_mm, vma->vm_start,
 					  vma->vm_end - vma->vm_start,
 					  find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip
 					    set_grant_ptes_as_special, NULL);
 		}
 #endif
-		map->pages_vm_start = vma->vm_start;
 	}
 
 	return 0;


Patches currently in stable-queue which might be from jgross@suse.com are

queue-4.13/xen-gntdev-avoid-out-of-bounds-access-in-case-of-partial-gntdev_mmap.patch
queue-4.13/xen-fix-booting-ballooned-down-hvm-guest.patch