From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752003AbdJYQpL (ORCPT ); Wed, 25 Oct 2017 12:45:11 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:49309 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751513AbdJYQpJ (ORCPT ); Wed, 25 Oct 2017 12:45:09 -0400 Subject: Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() To: Juergen Gross , linux-kernel@vger.kernel.org, xen-devel@lists.xenproject.org References: <20171025150807.11729-1-jgross@suse.com> Cc: stable@vger.kernel.org From: Boris Ostrovsky Message-ID: <11e7d8e0-3cc3-3266-c799-a2b30b1636ad@oracle.com> Date: Wed, 25 Oct 2017 12:46:37 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <20171025150807.11729-1-jgross@suse.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/25/2017 11:08 AM, Juergen Gross wrote: > In case gntdev_mmap() succeeds only partially in mapping grant pages > it will leave some vital information uninitialized needed later for > cleanup. This will lead to an out of bounds array access when unmapping > the already mapped pages. > > So just initialize the data needed for unmapping the pages a little bit > earlier. > > Cc: > Reported-by: Arthur Borsboom > Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky