Re: [PATCH v2 2/2] xen/gntalloc: validate grant count before allocation

[Jürgen Groß]

On 27.06.26 00:38, Yousef Alhouseen wrote:
> gntalloc_ioctl_alloc() allocates the grant-id array before checking
> whether the requested count fits within the global grant limit. Counts
> above that limit cannot succeed, so reject them before the
> user-controlled allocation reaches kcalloc().
>
> Use a subtraction-based check while holding gref_mutex so adding the
> requested count cannot wrap. Also cast the count before advancing the
> per-file index so the page-size multiplication is performed in 64-bit
> arithmetic.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature