From: Juergen Gross <jgross@xxxxxxxx> Commit 33172ab50a53578a95691310f49567c9266968b0 upstream. It isn't enough to check whether a grant is still being in use by calling gnttab_query_foreign_access(), as a mapping could be realized by the other side just after having called that function. In case the call was done in preparation of revoking a grant it is better to do so via gnttab_try_end_foreign_access() and check the success of that operation instead. This is CVE-2022-23038 / part of XSA-396. Reported-by: Demi Marie Obenour <demi@xxxxxxxxxxxxxxxxxxxxxx> Signed-off-by: Juergen Gross <jgross@xxxxxxxx> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/scsi/xen-scsifront.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/scsi/xen-scsifront.c +++ b/drivers/scsi/xen-scsifront.c @@ -233,12 +233,11 @@ static void scsifront_gnttab_done(struct return; for (i = 0; i < shadow->nr_grants; i++) { - if (unlikely(gnttab_query_foreign_access(shadow->gref[i]))) { + if (unlikely(!gnttab_try_end_foreign_access(shadow->gref[i]))) { shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME "grant still in use by backend\n"); BUG(); } - gnttab_end_foreign_access(shadow->gref[i], 0, 0UL); } kfree(shadow->sg); Patches currently in stable-queue which might be from jgross@xxxxxxxx are queue-5.16/xen-remove-gnttab_query_foreign_access.patch queue-5.16/xen-netfront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch queue-5.16/xen-scsifront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch queue-5.16/xen-gnttab-fix-gnttab_end_foreign_access-without-page-specified.patch queue-5.16/xen-netfront-react-properly-to-failing-gnttab_end_foreign_access_ref.patch queue-5.16/xen-gntalloc-don-t-use-gnttab_query_foreign_access.patch queue-5.16/xen-xenbus-don-t-let-xenbus_grant_ring-remove-grants-in-error-case.patch queue-5.16/xen-grant-table-add-gnttab_try_end_foreign_access.patch queue-5.16/xen-9p-use-alloc-free_pages_exact.patch queue-5.16/xen-blkfront-don-t-use-gnttab_query_foreign_access-for-mapped-status.patch queue-5.16/xen-pvcalls-use-alloc-free_pages_exact.patch