Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1112bb31 authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/netfront: don't use gnttab_query_foreign_access() for mapped status 



Commit 31185df7e2b1d2fa1de4900247a12d7b9c7087eb upstream.

It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.

In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_end_foreign_access_ref() and check the
success of that operation instead.

This is CVE-2022-23037 / part of XSA-396.

Reported-by: default avatarDemi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f3065750

drivers/net/xen-netfront.c

+2 −4
Original line number Diff line number Diff line
@@ -413,14 +413,12 @@ static bool xennet_tx_buf_gc(struct netfront_queue *queue) 
			queue->tx_link[id] = TX_LINK_NONE;

			skb = queue->tx_skbs[id];

			queue->tx_skbs[id] = NULL;

			if (unlikely(gnttab_query_foreign_access(

				queue->grant_tx_ref[id]) != 0)) {

			if (unlikely(!gnttab_end_foreign_access_ref(

				queue->grant_tx_ref[id], GNTMAP_readonly))) {

				dev_alert(dev,

					  "Grant still in use by backend domain\n");

				goto err;

			}

			gnttab_end_foreign_access_ref(

				queue->grant_tx_ref[id], GNTMAP_readonly);

			gnttab_release_grant_reference(

				&queue->gref_tx_head, queue->grant_tx_ref[id]);

			queue->grant_tx_ref[id] = GRANT_INVALID_REF;