xen/gntdev: fix unsafe vma access

Browse source

In gntdev_ioctl_get_offset_for_vaddr, we need to hold mmap_sem while
calling find_vma() to avoid potentially having the result freed out from
under us.  Similarly, the MMU notifier functions need to synchronize with
gntdev_vma_close to avoid map->vma being freed during their iteration.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

...

This commit is contained in:

Daniel De Graaf 2013-01-02 22:57:11 +00:00 • committed by Konrad Rzeszutek Wilk

parent 99beae6cb8

commit 2512f298cb

1 changed files with 24 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

29

drivers/xen/gntdev.c

View file