From: Greg Kroah-Hartman Date: Tue, 30 Mar 2021 12:26:37 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.11.11~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=50378cd2676989e6da3c5f3401864b6abc3a3d39;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: xen-blkback-don-t-leak-persistent-grants-from.patch --- diff --git a/queue-4.9/series b/queue-4.9/series index 39204a1ed9a..e95045e61aa 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -51,3 +51,4 @@ can-dev-move-device-back-to-init-netns-on-owning-netns-delete.patch net-sched-validate-stab-values.patch net-qrtr-fix-a-kernel-infoleak-in-qrtr_recvmsg.patch mac80211-fix-double-free-in-ibss_leave.patch +xen-blkback-don-t-leak-persistent-grants-from.patch diff --git a/queue-4.9/xen-blkback-don-t-leak-persistent-grants-from.patch b/queue-4.9/xen-blkback-don-t-leak-persistent-grants-from.patch new file mode 100644 index 00000000000..4b6c98562e7 --- /dev/null +++ b/queue-4.9/xen-blkback-don-t-leak-persistent-grants-from.patch @@ -0,0 +1,36 @@ +From b7649f4e1d73402aaf46cb8260df6161b101b593 Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Fri, 26 Mar 2021 16:28:57 +0100 +Subject: xen-blkback: don't leak persistent grants from xen_blkbk_map() + +From: Jan Beulich + +commit a846738f8c3788d846ed1f587270d2f2e3d32432 upstream. + +The fix for XSA-365 zapped too many of the ->persistent_gnt[] entries. +Ones successfully obtained should not be overwritten, but instead left +for xen_blkbk_unmap_prepare() to pick up and put. + +This is XSA-371. + +Signed-off-by: Jan Beulich +Cc: stable@vger.kernel.org +Reviewed-by: Juergen Gross +Reviewed-by: Wei Liu +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/xen-blkback/blkback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -937,7 +937,7 @@ next: + out: + for (i = last_map; i < num; i++) { + /* Don't zap current batch's valid persistent grants. */ +- if(i >= last_map + segs_to_map) ++ if(i >= map_until) + pages[i]->persistent_gnt = NULL; + pages[i]->handle = BLKBACK_INVALID_HANDLE; + }