From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932402AbdJZWxe (ORCPT ); Thu, 26 Oct 2017 18:53:34 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:41830 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751305AbdJZWxa (ORCPT ); Thu, 26 Oct 2017 18:53:30 -0400 Subject: Re: [PATCH] xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() To: Juergen Gross , linux-kernel@vger.kernel.org, xen-devel@lists.xenproject.org References: <20171025150807.11729-1-jgross@suse.com> <11e7d8e0-3cc3-3266-c799-a2b30b1636ad@oracle.com> Cc: stable@vger.kernel.org From: Boris Ostrovsky Message-ID: <5f9794ec-1fa2-f51f-8ecf-a922646364e1@oracle.com> Date: Thu, 26 Oct 2017 18:54:55 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <11e7d8e0-3cc3-3266-c799-a2b30b1636ad@oracle.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/25/2017 12:46 PM, Boris Ostrovsky wrote: > On 10/25/2017 11:08 AM, Juergen Gross wrote: >> In case gntdev_mmap() succeeds only partially in mapping grant pages >> it will leave some vital information uninitialized needed later for >> cleanup. This will lead to an out of bounds array access when unmapping >> the already mapped pages. >> >> So just initialize the data needed for unmapping the pages a little bit >> earlier. >> >> Cc: >> Reported-by: Arthur Borsboom >> Signed-off-by: Juergen Gross > Reviewed-by: Boris Ostrovsky > Applied to for-linus-4.14c. -boris