From: Juergen Gross <jgross@xxxxxxxx>
Commit 31185df7e2b1d2fa1de4900247a12d7b9c7087eb upstream.
It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.
In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_end_foreign_access_ref() and check the
success of that operation instead.
This is CVE-2022-23037 / part of XSA-396.
Reported-by: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/net/xen-netfront.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -424,14 +424,12 @@ static bool xennet_tx_buf_gc(struct netf
queue->tx_link[id] = TX_LINK_NONE;
skb = queue->tx_skbs[id];
queue->tx_skbs[id] = NULL;
- if (unlikely(gnttab_query_foreign_access(
- queue->grant_tx_ref[id]) != 0)) {
+ if (unlikely(!gnttab_end_foreign_access_ref(
+ queue->grant_tx_ref[id], GNTMAP_readonly))) {
dev_alert(dev,
"Grant still in use by backend domain\n");
goto err;
}
- gnttab_end_foreign_access_ref(
- queue->grant_tx_ref[id], GNTMAP_readonly);
gnttab_release_grant_reference(
&queue->gref_tx_head, queue->grant_tx_ref[id]);
queue->grant_tx_ref[id] = GRANT_INVALID_REF;
Patches currently in stable-queue which might be from jgross@xxxxxxxx are
queue-5.16/xen-remove-gnttab_query_foreign_access.patch
queue-5.16/xen-netfront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch
queue-5.16/xen-scsifront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch
queue-5.16/xen-gnttab-fix-gnttab_end_foreign_access-without-page-specified.patch
queue-5.16/xen-netfront-react-properly-to-failing-gnttab_end_foreign_access_ref.patch
queue-5.16/xen-gntalloc-don-t-use-gnttab_query_foreign_access.patch
queue-5.16/xen-xenbus-don-t-let-xenbus_grant_ring-remove-grants-in-error-case.patch
queue-5.16/xen-grant-table-add-gnttab_try_end_foreign_access.patch
queue-5.16/xen-9p-use-alloc-free_pages_exact.patch
queue-5.16/xen-blkfront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch
queue-5.16/xen-pvcalls-use-alloc-free_pages_exact.patch
