diff options
| author | Juergen Gross <jgross@suse.com> | 2022-02-25 16:05:41 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-03-11 11:22:39 +0100 |
| commit | b507879c1e2d2c55752f658439df71595f4adff2 (patch) | |
| tree | 5c77ce2be6dafec8544fb3f267ef698f1f4dde51 | |
| parent | a83400456f9c21b23ece54b7ff8fea5e6109f26c (diff) | |
| download | linux-b507879c1e2d2c55752f658439df71595f4adff2.tar.gz linux-b507879c1e2d2c55752f658439df71595f4adff2.tar.bz2 linux-b507879c1e2d2c55752f658439df71595f4adff2.zip | |
xen/netfront: don't use gnttab_query_foreign_access() for mapped status
Commit 31185df7e2b1d2fa1de4900247a12d7b9c7087eb upstream.
It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.
In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_end_foreign_access_ref() and check the
success of that operation instead.
This is CVE-2022-23037 / part of XSA-396.
Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/xen-netfront.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index d45d83968e76..5aad0ccd4aa0 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -412,14 +412,12 @@ static bool xennet_tx_buf_gc(struct netfront_queue *queue) queue->tx_link[id] = TX_LINK_NONE; skb = queue->tx_skbs[id]; queue->tx_skbs[id] = NULL; - if (unlikely(gnttab_query_foreign_access( - queue->grant_tx_ref[id]) != 0)) { + if (unlikely(!gnttab_end_foreign_access_ref( + queue->grant_tx_ref[id], GNTMAP_readonly))) { dev_alert(dev, "Grant still in use by backend domain\n"); goto err; } - gnttab_end_foreign_access_ref( - queue->grant_tx_ref[id], GNTMAP_readonly); gnttab_release_grant_reference( &queue->gref_tx_head, queue->grant_tx_ref[id]); queue->grant_tx_ref[id] = GRANT_INVALID_REF; |