xen/gnttab: Properly drop page ref on a GNTTAB_cache_flush error path
PATCH 1/1 xen/gnttab: Properly drop page ref on a GNTTAB_cache_flush error path
From: Jan Beulich <[email protected]>
This patch was XSA-520 in Xen 4.20 and earlier, as it affected security supported x86 cases.
In Xen 4.21 and later, the hypercall is only available to ARM. Nevertheless, there are two identified cases (STATIC_MEM and the xentrace buffers) on ARM where system domains own memory, and need this error path.
--- xen/common/grant_table.c | 2 ++ 1 file changed, 2 insertions(+)
xen/common/grant_table.c +2 -0
@@ -3635,6 +3635,8 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, grant_ref_t *cur_ref) owner =page_get_owner_and_reference (page);if ( !owner || !owner->grant_table ) { +if ( owner ) +put_page (page);rcu_unlock_domain (d);return -EPERM ; }
base-commit: 204e45847d5a743b611de989835f651fcfd6ddc0
Signature · 1 line
2.39.5
Quoted 9 lines · Andrew Cooper
From: Jan Beulich <[email protected]>
This patch was XSA-520 in Xen 4.20 and earlier, as it affected security supported x86 cases.
In Xen 4.21 and later, the hypercall is only available to ARM. Nevertheless, there are two identified cases (
STATIC_MEMand the xentrace buffers) on ARM where system domains own memory, and need this error path.
Quoted 6 lines
Reported-by Andrew Cooper <[email protected]>Reported-by Yehyeong Lee <[email protected]>Reported-by Teddy Astie <[email protected]>Reported-by Stefano Stabellini <[email protected]>Signed-off-by Jan Beulich <[email protected]>Signed-off-by Andrew Cooper <[email protected]>
And I will want to include this in my next stable backport run, planned for tomorrow (if internet availability permits). Therefore if you don't get to committing this tonight, I may take the liberty of including it (about) first thing tomorrow morning.
Jan