Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41722344 authored by Juergen Gross's avatar Juergen Gross Committed by Greg Kroah-Hartman
Browse files

xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status 



[ Upstream commit 6b51fd3f65a22e3d1471b18a1d56247e246edd46 ]

xenbus_map_ring_valloc() maps a ring page and returns the status of the
used grant (0 meaning success).

There are Xen hypervisors which might return the value 1 for the status
of a failed grant mapping due to a bug. Some callers of
xenbus_map_ring_valloc() test for errors by testing the returned status
to be less than zero, resulting in no error detected and crashing later
due to a not available ring page.

Set the return value of xenbus_map_ring_valloc() to GNTST_general_error
in case the grant status reported by Xen is greater than zero.

This is part of XSA-316.

Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Reviewed-by: default avatarWei Liu <wl@xen.org>
Link: https://lore.kernel.org/r/20200326080358.1018-1-jgross@suse.com


Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 6e575122

drivers/xen/xenbus/xenbus_client.c

+8 −1
Original line number Diff line number Diff line
@@ -450,7 +450,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn); 
int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,

			   unsigned int nr_grefs, void **vaddr)

{

	return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);

	int err;



	err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);

	/* Some hypervisors are buggy and can return 1. */

	if (err > 0)

		err = GNTST_general_error;



	return err;

}

EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);