Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be63ea88 authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/9p: use alloc/free_pages_exact() 



Commit 5cadd4bb1d7fc9ab201ac14620d1a478357e4ebd upstream.

Instead of __get_free_pages() and free_pages() use alloc_pages_exact()
and free_pages_exact(). This is in preparation of a change of
gnttab_end_foreign_access() which will prohibit use of high-order
pages.

By using the local variable "order" instead of ring->intf->ring_order
in the error path of xen_9pfs_front_alloc_dataring() another bug is
fixed, as the error path can be entered before ring->intf->ring_order
is being set.

By using alloc_pages_exact() the size in bytes is specified for the
allocation, which fixes another bug for the case of
order < (PAGE_SHIFT - XEN_PAGE_SHIFT).

This is part of CVE-2022-23041 / XSA-396.

Reported-by: default avatarSimon Gaiser <simon@invisiblethingslab.com>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8efaf0c8

net/9p/trans_xen.c

+6 −8
Original line number Diff line number Diff line
@@ -301,9 +301,9 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) 
				ref = priv->rings[i].intf->ref[j];

				gnttab_end_foreign_access(ref, 0, 0);

			}

			free_pages((unsigned long)priv->rings[i].data.in,

				   XEN_9PFS_RING_ORDER -

				   (PAGE_SHIFT - XEN_PAGE_SHIFT));

			free_pages_exact(priv->rings[i].data.in,

				   1UL << (XEN_9PFS_RING_ORDER +

					   XEN_PAGE_SHIFT));

		}

		gnttab_end_foreign_access(priv->rings[i].ref, 0, 0);

		free_page((unsigned long)priv->rings[i].intf);
@@ -341,8 +341,8 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev, 
	if (ret < 0)

		goto out;

	ring->ref = ret;

	bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,

			XEN_9PFS_RING_ORDER - (PAGE_SHIFT - XEN_PAGE_SHIFT));

	bytes = alloc_pages_exact(1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT),

				  GFP_KERNEL | __GFP_ZERO);

	if (!bytes) {

		ret = -ENOMEM;

		goto out;
@@ -373,9 +373,7 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev, 
	if (bytes) {

		for (i--; i >= 0; i--)

			gnttab_end_foreign_access(ring->intf->ref[i], 0, 0);

		free_pages((unsigned long)bytes,

			   XEN_9PFS_RING_ORDER -

			   (PAGE_SHIFT - XEN_PAGE_SHIFT));

		free_pages_exact(bytes, 1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT));

	}

	gnttab_end_foreign_access(ring->ref, 0, 0);

	free_page((unsigned long)ring->intf);