Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f85d03f0 authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/pvcalls: use alloc/free_pages_exact() 



Commit b0576cc9c6b843d99c6982888d59a56209341888 upstream.

Instead of __get_free_pages() and free_pages() use alloc_pages_exact()
and free_pages_exact(). This is in preparation of a change of
gnttab_end_foreign_access() which will prohibit use of high-order
pages.

This is part of CVE-2022-23041 / XSA-396.

Reported-by: default avatarSimon Gaiser <simon@invisiblethingslab.com>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2466bed3

drivers/xen/pvcalls-front.c

+4 −4
Original line number Diff line number Diff line
@@ -346,8 +346,8 @@ static void free_active_ring(struct sock_mapping *map) 
	if (!map->active.ring)

		return;



	free_pages((unsigned long)map->active.data.in,

			map->active.ring->ring_order);

	free_pages_exact(map->active.data.in,

			 PAGE_SIZE << map->active.ring->ring_order);

	free_page((unsigned long)map->active.ring);

}
@@ -361,8 +361,8 @@ static int alloc_active_ring(struct sock_mapping *map) 
		goto out;



	map->active.ring->ring_order = PVCALLS_RING_ORDER;

	bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,

					PVCALLS_RING_ORDER);

	bytes = alloc_pages_exact(PAGE_SIZE << PVCALLS_RING_ORDER,

				  GFP_KERNEL | __GFP_ZERO);

	if (!bytes)

		goto out;