lkml.org 
[lkml]   [2020]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 63/70] xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
    Date
    From: Juergen Gross <jgross@suse.com>

    [ Upstream commit 6b51fd3f65a22e3d1471b18a1d56247e246edd46 ]

    xenbus_map_ring_valloc() maps a ring page and returns the status of the
    used grant (0 meaning success).

    There are Xen hypervisors which might return the value 1 for the status
    of a failed grant mapping due to a bug. Some callers of
    xenbus_map_ring_valloc() test for errors by testing the returned status
    to be less than zero, resulting in no error detected and crashing later
    due to a not available ring page.

    Set the return value of xenbus_map_ring_valloc() to GNTST_general_error
    in case the grant status reported by Xen is greater than zero.

    This is part of XSA-316.

    Signed-off-by: Juergen Gross <jgross@suse.com>
    Reviewed-by: Wei Liu <wl@xen.org>
    Link: https://lore.kernel.org/r/20200326080358.1018-1-jgross@suse.com
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/xen/xenbus/xenbus_client.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)

    diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
    index 056da6ee1a357..df27cefb2fa35 100644
    --- a/drivers/xen/xenbus/xenbus_client.c
    +++ b/drivers/xen/xenbus/xenbus_client.c
    @@ -469,7 +469,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn);
    int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
    unsigned int nr_grefs, void **vaddr)
    {
    - return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
    + int err;
    +
    + err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
    + /* Some hypervisors are buggy and can return 1. */
    + if (err > 0)
    + err = GNTST_general_error;
    +
    + return err;
    }
    EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-05-01 15:28    [W:4.050 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site