VT-d: fix deassign of device with RMRR
authorJan Beulich <jbeulich@suse.com>
Fri, 1 Oct 2021 13:05:42 +0000 (15:05 +0200)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 5 Oct 2021 18:49:07 +0000 (19:49 +0100)
commitba45e99aa4da5dae6f42819ceb9372764fea410d
treec5a0a3e332467cca9dbd0421e48e2bacf7370fcb
parent9f2b6c5ec2ded4c1caf149743e862c5f15d6d083
VT-d: fix deassign of device with RMRR

Ignoring a specific error code here was not meant to short circuit
deassign to _just_ the unmapping of RMRRs. This bug was previously
hidden by the bogus (potentially indefinite) looping in
pci_release_devices(), until f591755823a7 ("IOMMU/PCI: don't let domain
cleanup continue when device de-assignment failed") fixed that loop.

This is CVE-2021-28702 / XSA-386.

Fixes: 8b99f4400b69 ("VT-d: fix RMRR related error handling")
Reported-by: Ivan Kardykov <kardykov@tabit.pro>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Ivan Kardykov <kardykov@tabit.pro>
(cherry picked from commit 24ebe875a77833696bbe5c9372e9e1590a7e7101)
xen/drivers/passthrough/vtd/iommu.c