Commit 98bdfdf8 authored Feb 25, 2022 by Juergen Gross Committed by Greg Kroah-Hartman Mar 11, 2022

xen/scsifront: don't use gnttab_query_foreign_access() for mapped status



Commit 33172ab50a53578a95691310f49567c9266968b0 upstream.

It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.

In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_try_end_foreign_access() and check the
success of that operation instead.

This is CVE-2022-23038 / part of XSA-396.

Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 1112bb31

drivers/scsi/xen-scsifront.c

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -210,12 +210,11 @@ static void scsifront_gnttab_done(struct vscsifrnt_info *info, uint32_t id)
	return;		return;

	for (i = 0; i < s->nr_grants; i++) {		for (i = 0; i < s->nr_grants; i++) {
	if (unlikely(gnttab_query_foreign_access(s->gref[i]) != 0)) {		if (unlikely(!gnttab_try_end_foreign_access(s->gref[i]))) {
	shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME		shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME
	"grant still in use by backend\n");		"grant still in use by backend\n");
	BUG();		BUG();
	}		}
	gnttab_end_foreign_access(s->gref[i], 0, 0UL);
	}		}

	kfree(s->sg);		kfree(s->sg);