github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

xen: XSA-485 and XSA-487 security patches for v7.1

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCaeoflBsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQgFxhu0/YY75GSAD/RZ0vMd5FHkPkcx5C4Q3c
 VK12E6+fQT5CEp7E9Sg2mBEBAOhzi8WMYR5b3nlEQWKRraFg651+do9Tt1QspKdW
 /IEG
 =LCjg
 -----END PGP SIGNATURE-----

Merge tag 'xsa48x-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:
 "XSA-485 and XSA-487 security patches"

* tag 'xsa48x-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/privcmd: fix double free via VMA splitting
  Buffer overflow in drivers/xen/sys-hypervisor.c
This commit is contained in:
Linus Torvalds 2026-04-27 18:36:47 -07:00
commit dca922e019
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/xen/privcmd.c
View File

@ -1620,6 +1620,12 @@ static void privcmd_close(struct vm_area_struct *vma)
kvfree(pages);
}
static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr)
{
/* Forbid splitting, avoids double free via privcmd_close(). */
return -EINVAL;
}
static vm_fault_t privcmd_fault(struct vm_fault *vmf)
{
printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n",
@ -1631,6 +1637,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf)
static const struct vm_operations_struct privcmd_vm_ops = {
.close = privcmd_close,
.may_split = privcmd_may_split,
.fault = privcmd_fault
};

8
drivers/xen/sys-hypervisor.c
View File

@ -366,6 +366,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
ret = sprintf(buffer, "<denied>");
return ret;
}
if (ret > PAGE_SIZE)
return -ENOSPC;
buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL);
if (!buildid)
@ -373,8 +375,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
buildid->len = ret;
ret = HYPERVISOR_xen_version(XENVER_build_id, buildid);
if (ret > 0)
ret = sprintf(buffer, "%s", buildid->buf);
if (ret > 0) {
/* Build id is binary, not a string. */
memcpy(buffer, buildid->buf, ret);
}
kfree(buildid);
return ret;