Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 089a8e49 authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/scsifront: don't use gnttab_query_foreign_access() for mapped status 



Commit 33172ab50a53578a95691310f49567c9266968b0 upstream.

It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.

In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_try_end_foreign_access() and check the
success of that operation instead.

This is CVE-2022-23038 / part of XSA-396.

Reported-by: default avatarDemi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarJan Beulich <jbeulich@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b507879c

drivers/scsi/xen-scsifront.c

+1 −2
Original line number Diff line number Diff line
@@ -233,12 +233,11 @@ static void scsifront_gnttab_done(struct vscsifrnt_info *info, 
		return;



	for (i = 0; i < shadow->nr_grants; i++) {

		if (unlikely(gnttab_query_foreign_access(shadow->gref[i]))) {

		if (unlikely(!gnttab_try_end_foreign_access(shadow->gref[i]))) {

			shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME

				     "grant still in use by backend\n");

			BUG();

		}

		gnttab_end_foreign_access(shadow->gref[i], 0, 0UL);

	}



	kfree(shadow->sg);