diff options
| author | Juergen Gross <jgross@suse.com> | 2022-03-07 09:48:54 +0100 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2022-03-07 09:48:54 +0100 |
| commit | 33172ab50a53578a95691310f49567c9266968b0 (patch) | |
| tree | 00b45df7f3fdb7da703fe3fd8aa9d24d2e5e95ea | |
| parent | 31185df7e2b1d2fa1de4900247a12d7b9c7087eb (diff) | |
| download | linux-33172ab50a53578a95691310f49567c9266968b0.tar.gz | |
xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.
In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_try_end_foreign_access() and check the
success of that operation instead.
This is CVE-2022-23038 / part of XSA-396.
Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
V2:
- use gnttab_try_end_foreign_access()
| -rw-r--r-- | drivers/scsi/xen-scsifront.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c index 12c10a5e3d93a3..7f421600cb66df 100644 --- a/drivers/scsi/xen-scsifront.c +++ b/drivers/scsi/xen-scsifront.c @@ -233,12 +233,11 @@ static void scsifront_gnttab_done(struct vscsifrnt_info *info, return; for (i = 0; i < shadow->nr_grants; i++) { - if (unlikely(gnttab_query_foreign_access(shadow->gref[i]))) { + if (unlikely(!gnttab_try_end_foreign_access(shadow->gref[i]))) { shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME "grant still in use by backend\n"); BUG(); } - gnttab_end_foreign_access(shadow->gref[i], 0, 0UL); } kfree(shadow->sg); |