mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-08 17:49:45 +00:00
xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
[ Upstream commit 6b51fd3f65
]
xenbus_map_ring_valloc() maps a ring page and returns the status of the
used grant (0 meaning success).
There are Xen hypervisors which might return the value 1 for the status
of a failed grant mapping due to a bug. Some callers of
xenbus_map_ring_valloc() test for errors by testing the returned status
to be less than zero, resulting in no error detected and crashing later
due to a not available ring page.
Set the return value of xenbus_map_ring_valloc() to GNTST_general_error
in case the grant status reported by Xen is greater than zero.
This is part of XSA-316.
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Link: https://lore.kernel.org/r/20200326080358.1018-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
6e575122cd
commit
4172234498
1 changed files with 8 additions and 1 deletions
|
@ -450,7 +450,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn);
|
|||
int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
|
||||
unsigned int nr_grefs, void **vaddr)
|
||||
{
|
||||
return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
|
||||
int err;
|
||||
|
||||
err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
|
||||
/* Some hypervisors are buggy and can return 1. */
|
||||
if (err > 0)
|
||||
err = GNTST_general_error;
|
||||
|
||||
return err;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);
|
||||
|
||||
|
|
Loading…
Reference in a new issue