lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xen/netfront: don't use gnttab_query_foreign_access() for mapped status

Browse Source 
Commit 31185df7e2b1d2fa1de4900247a12d7b9c7087eb upstream.

It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.

In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_end_foreign_access_ref() and check the
success of that operation instead.

This is CVE-2022-23037 / part of XSA-396.

Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Juergen Gross 2022-02-25 16:05:41 +01:00 committed by Greg Kroah-Hartman
parent a83400456f
commit b507879c1e
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/xen-netfront.c
View File

@ -412,14 +412,12 @@ static bool xennet_tx_buf_gc(struct netfront_queue *queue)
queue->tx_link[id] = TX_LINK_NONE; queue->tx_link[id] = TX_LINK_NONE;
skb = queue->tx_skbs[id]; skb = queue->tx_skbs[id];
queue->tx_skbs[id] = NULL; queue->tx_skbs[id] = NULL;
if (unlikely(gnttab_query_foreign_access( if (unlikely(!gnttab_end_foreign_access_ref(
queue->grant_tx_ref[id]) != 0)) { queue->grant_tx_ref[id], GNTMAP_readonly))) {
dev_alert(dev, dev_alert(dev,
"Grant still in use by backend domain\n"); "Grant still in use by backend domain\n");
goto err; goto err;
} }
gnttab_end_foreign_access_ref(
queue->grant_tx_ref[id], GNTMAP_readonly);
gnttab_release_grant_reference( gnttab_release_grant_reference(
&queue->gref_tx_head, queue->grant_tx_ref[id]); &queue->gref_tx_head, queue->grant_tx_ref[id]);
queue->grant_tx_ref[id] = GRANT_INVALID_REF; queue->grant_tx_ref[id] = GRANT_INVALID_REF;