Juergen Gross 91eaad01bc xen/netfront: react properly to failing gnttab_end_foreign_access_ref() ...

Commit 66e3531b33 upstream.

When calling gnttab_end_foreign_access_ref() the returned value must
be tested and the reaction to that value should be appropriate.

In case of failure in xennet_get_responses() the reaction should not be
to crash the system, but to disable the network device.

The calls in setup_netfront() can be replaced by calls of
gnttab_end_foreign_access(). While at it avoid double free of ring
pages and grant references via xennet_disconnect_backend() in this case.

This is CVE-2022-23042 / part of XSA-396.

Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-16 12:45:43 +09:00

..

accessibility

…

acpi

ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()

2023-05-16 12:32:36 +09:00

amba

ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"

2023-05-16 12:02:23 +09:00

amlogic

tee: disable by default

2023-05-12 16:27:16 +09:00

android

binder: use wake_up_pollfree()

2023-05-16 12:22:16 +09:00

ata

ata: pata_hpt37x: fix PCI clock detection

2023-05-16 12:44:23 +09:00

atm

atm: nicstar: register the interrupt handler in the right place

2023-05-16 11:25:37 +09:00

auxdisplay

auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string

2023-05-16 12:15:31 +09:00

base

regmap: Fix possible double-free in regcache_rbtree_exit()

2023-05-16 12:02:02 +09:00

bcma

bcma: Fix memory leak for internally-handled cores

2023-05-16 11:44:50 +09:00

block

xen/blkfront: don't use gnttab_query_foreign_access() for mapped status

2023-05-16 12:45:35 +09:00

bluetooth

Bluetooth: bfusb: fix division by zero in send path

2023-05-16 12:30:31 +09:00

bus

bus: qcom: Put child node before return

2023-05-16 11:02:09 +09:00

cdrom

cdrom: gdrom: initialize global variable at init time

2023-05-16 11:05:40 +09:00

char

char/mwave: Adjust io port register size

2023-05-16 12:31:53 +09:00

clk

clk: kirkwood: Fix a clocking boot regression

2023-05-16 11:44:57 +09:00

clocksource

clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined

2023-05-16 10:37:41 +09:00

connector

…

cpufreq

cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory

2023-05-16 11:53:41 +09:00

cpuidle

cpuidle: Fix kobject memory leaks in error paths

2023-05-16 12:14:36 +09:00

crypto

crypto: qce - fix uaf on qce_ahash_register_one

2023-05-16 12:31:12 +09:00

dax

…

dca

…

devfreq

PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out

2023-05-16 09:14:54 +09:00

dio

…

dma

dmaengine: shdma: Fix runtime PM imbalance on error

2023-05-16 12:44:16 +09:00

dma-buf

dma-buf: Fix memory leak in sync_file_merge()

2023-05-15 16:17:55 +09:00

edac

EDAC: Fix calculation of returned address and next offset in edac_align_ptr()

2023-05-16 12:43:19 +09:00

eisa

…

extcon

extcon: max8997: Add missing modalias string

2023-05-16 11:24:53 +09:00

firewire

firewire: nosy: Fix a use-after-free bug in nosy_ioctl()

2023-05-16 10:50:08 +09:00

firmware

arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit()

2023-05-16 12:45:16 +09:00

fmc

…

fpga

…

gpio

gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use

2023-05-16 12:32:13 +09:00

gpu

drm/edid: Always set RGB444

2023-05-16 12:43:44 +09:00

hardkernel

ODROID-G12: Make hid-multitouch and dwav-usb-mt driver as mouldes.

2022-03-15 09:20:56 +09:00

hid

HID: add mapping for KEY_ALL_APPLICATIONS

2023-05-16 12:44:50 +09:00

hsi

HSI: core: Fix return freed object in hsi_new_client

2023-05-16 12:32:14 +09:00

hv

hyperv/vmbus: include linux/bitops.h

2023-05-16 12:12:51 +09:00

hwmon

hwmon: (dell-smm) Speed up setting of fan speed

2023-05-16 12:42:27 +09:00

hwspinlock

…

hwtracing

intel_th: Consistency and off-by-one fix

2023-05-16 10:53:58 +09:00

i2c

i2c: qup: allow COMPILE_TEST

2023-05-16 12:44:17 +09:00

ide

block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>

2023-05-16 09:04:57 +09:00

idle

x86/cpu: Sanitize FAM6_ATOM naming

2023-05-15 12:46:28 +09:00

iio

iio: adc: men_z188_adc: Fix a resource leak in an error handling path

2023-05-16 12:43:49 +09:00

infiniband

RDMA/ib_srp: Fix a deadlock

2023-05-16 12:43:47 +09:00

input

Input: elan_i2c - fix regulator enable count imbalance after suspend/resume

2023-05-16 12:44:49 +09:00

iommu

iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()

2023-05-16 12:35:25 +09:00

ipack

ipack: ipoctal: fix module reference leak

2023-05-16 11:53:57 +09:00

irqchip

irqchip: nvic: Fix offset for Interrupt Priority Offsets

2023-05-16 12:22:46 +09:00

isdn

mISDN: change function names to avoid conflicts

2023-05-16 12:30:26 +09:00

leds

leds: ktd2692: Fix an error handling path

2023-05-16 11:24:56 +09:00

lguest

…

lightnvm

…

macintosh

drivers/macintosh: Fix memleak in windfarm_pm112 driver

2023-05-15 17:34:39 +09:00

mailbox

mailbox: handle failed named mailbox channel request

2023-05-15 14:08:07 +09:00

mcb

mcb: fix error handling in mcb_alloc_bus()

2023-05-16 11:53:10 +09:00

md

dm space map common: add bounds check to sm_ll_lookup_bitmap()

2023-05-16 12:32:42 +09:00

media

media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()

2023-05-16 12:34:21 +09:00

memory

memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe

2023-05-16 12:15:13 +09:00

memstick

memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()

2023-05-16 12:14:44 +09:00

message

scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()

2023-05-16 09:45:15 +09:00

mfd

mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()

2023-05-16 12:30:35 +09:00

misc

misc: lattice-ecp3-config: Fix task hung when firmware load failed

2023-05-16 12:32:00 +09:00

mmc

moxart: fix potential use-after-free on remove path

2023-05-16 12:41:25 +09:00

mtd

mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status

2023-05-16 12:43:30 +09:00

net

xen/netfront: react properly to failing gnttab_end_foreign_access_ref()

2023-05-16 12:45:43 +09:00

nfc

nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails

2023-05-16 12:15:47 +09:00

ntb

NTB: hw: amd: fix an issue about leak system resources

2023-05-16 09:39:21 +09:00

nubus

…

nvdimm

libnvdimm/dimm: Avoid race between probe and available_slots_show()

2023-05-16 10:38:48 +09:00

nvme

nvme-pci: Fix an error handling path in 'nvme_probe()'

2023-05-16 11:43:31 +09:00

nvmem

nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

2023-05-16 12:00:53 +09:00

of

of: Fix truncation of memory sizes on 32-bit platforms

2023-05-16 11:24:47 +09:00

oprofile

…

parisc

parisc: Fix sglist access in ccio-dma.c

2023-05-16 12:42:44 +09:00

parport

parport: remove non-zero check on count

2023-05-16 11:46:21 +09:00

pci

PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller

2023-05-16 12:31:04 +09:00

pcmcia

pcmcia: fix setting of kthread task states

2023-05-16 12:31:40 +09:00

perf

drivers/perf: arm_pmu: Fix failure path in PM notifier

2023-05-15 14:09:37 +09:00

phy

phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()

2023-05-16 11:24:50 +09:00

pinctrl

pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()

2023-05-16 11:45:22 +09:00

platform

platform/x86: apple-gmux: use resource_size() with res

2023-05-16 12:29:34 +09:00

pnp

…

power

power: bq25890: Enable continuous conversion for ADC at charging

2023-05-16 12:33:07 +09:00

powercap

powercap: restrict energy meter to root access

2023-05-16 09:46:33 +09:00

pps

drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl

2023-05-15 14:08:51 +09:00

ps3

powerpc/ps3: use dma_mapping_error()

2023-05-16 09:58:13 +09:00

ptp

ptp_pch: Load module automatically if ID matches

2023-05-16 12:00:25 +09:00

pwm

pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered

2023-05-16 11:52:37 +09:00

rapidio

rapidio: handle create_workqueue() failure

2023-05-16 11:05:25 +09:00

ras

…

regulator

regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled

2023-05-16 12:13:12 +09:00

remoteproc

remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load

2023-05-16 10:35:30 +09:00

reset

reset: ti-syscon: fix to_ti_syscon_reset_data macro

2023-05-16 11:33:29 +09:00

rpmsg

rpmsg: smd: fix memory leak on channel create

2023-05-15 09:23:11 +09:00

rtc

rtc: cmos: Evaluate century appropriate

2023-05-16 12:35:35 +09:00

s390

scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices

2023-05-16 12:34:37 +09:00

sbus

drivers/sbus/char: add of_node_put()

2023-05-15 10:37:00 +09:00

scsi

xen/scsifront: don't use gnttab_query_foreign_access() for mapped status

2023-05-16 12:45:38 +09:00

sfi

…

sh

maple: fix wrong return value of maple_bus_init().

2023-05-16 12:16:16 +09:00

sn

…

soc

soc: fsl: qe: Check of ioremap return value

2023-05-16 12:44:45 +09:00

spi

spi: mediatek: Avoid NULL pointer crash in interrupt

2023-05-16 12:35:27 +09:00

spmi

…

ssb

ssb: sdio: Don't overwrite const buffer if block_write fails

2023-05-16 11:22:54 +09:00

staging

staging: fbtft: Fix error path in fbtft_driver_module_init()

2023-05-16 12:42:02 +09:00

target

scsi: target: iscsi: Make sure the np under each tpg is unique

2023-05-16 12:41:58 +09:00

tc

TC: Set DMA masks for devices

2023-05-15 09:23:01 +09:00

tee

UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference

2023-05-16 09:46:44 +09:00

thermal

thermal: core: Reset previous low and high trip during thermal zone init

2023-05-16 12:21:27 +09:00

thunderbolt

thunderbolt: Use 32-bit writes when writing ring producer/consumer

2023-05-15 14:55:28 +09:00

tty

tty: n_gsm: fix proper link termination after failed open

2023-05-16 12:44:04 +09:00

uio

uio_pdrv_genirq: fix use without device tree and no interrupt

2023-05-16 08:31:00 +09:00

usb

usb: gadget: clear related members when goto fail

2023-05-16 12:44:22 +09:00

uwb

uwb: hwa-rc: fix memory leak at probe

2023-05-15 08:28:33 +09:00

vfio

vfio: Use config not menuconfig for VFIO_NOIOMMU

2023-05-16 11:45:19 +09:00

vhost

vhost/vsock: don't check owner in vhost_vsock_stop() while releasing

2023-05-16 12:43:31 +09:00

video

vgacon: Propagate console boot parameters before calling `vc_resize'

2023-05-16 12:21:43 +09:00

virt

drivers/virt/fsl_hypervisor: Fix error handling path

2023-05-16 09:38:07 +09:00

virtio

virtio_pci: Support surprise removal of virtio pci device

2023-05-16 12:29:55 +09:00

vlynq

…

vme

vme: bridges: reduce stack usage

2023-05-15 16:59:11 +09:00

w1

w1: Misuse of get_user()/put_user() reported by sparse

2023-05-16 12:32:58 +09:00

watchdog

watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT

2023-05-16 12:15:35 +09:00

xen

xen/gnttab: fix gnttab_end_foreign_access() without page specified

2023-05-16 12:45:42 +09:00

zorro

zorro: Set up z->dev.dma_mask for the DMA API

2018-05-30 07:50:44 +02:00

Kconfig

ODROID: sysfs: Add poweroff_trigger sysfs node.

2019-12-11 18:21:09 +09:00

Makefile

ODROID: sysfs: Add poweroff_trigger sysfs node.

2019-12-11 18:21:09 +09:00