xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()
authorJuergen Gross <jgross@suse.com>
Wed, 25 Oct 2017 15:08:07 +0000 (17:08 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 2 Nov 2017 08:49:13 +0000 (09:49 +0100)
commitd431d9f122ab0ab8f268d6a67342a59a3f60ed8d
tree0cca9cbdc94860df9cbb013d703e315f4baa6e94
parent8783885ea7fefb68a44f39c73a1fe155798f8fce
xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

commit 298d275d4d9bea3524ff4bc76678c140611d8a8d upstream.

In case gntdev_mmap() succeeds only partially in mapping grant pages
it will leave some vital information uninitialized needed later for
cleanup. This will lead to an out of bounds array access when unmapping
the already mapped pages.

So just initialize the data needed for unmapping the pages a little bit
earlier.

Reported-by: Arthur Borsboom <arthurborsboom@gmail.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/xen/gntdev.c