From: Jan Beulich <jbeulich@suse.com>
Date: Thu, 7 Sep 2017 17:19:26 +0000 (+0100)
Subject: arm/mm: release grant lock on xenmem_add_to_physmap_one() error paths
X-Git-Tag: archive/raspbian/4.8.1-1+rpi1+deb9u3^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=5acd8408894849fc977c93df5452cdfbd24e167c;p=xen.git

arm/mm: release grant lock on xenmem_add_to_physmap_one() error paths

Commit 55021ff9ab ("xen/arm: add_to_physmap_one: Avoid to map mfn 0 if
an error occurs") introduced error paths not releasing the grant table
lock. Replace them by a suitable check after the lock was dropped.

This is XSA-235.

Reported-by: Wei Liu <wei.liu2@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Julien Grall <julien.grall@arm.com>


Gbp-Pq: Name armmm-release-grant-lock-on-xenmem_add_t
---

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 74acaf30d2..b69465d980 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -1112,7 +1112,7 @@ int xenmem_add_to_physmap_one(
             if ( idx < nr_status_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->status[idx]);
             else
-                return -EINVAL;
+                mfn = mfn_x(INVALID_MFN);
         }
         else
         {
@@ -1123,14 +1123,21 @@ int xenmem_add_to_physmap_one(
             if ( idx < nr_grant_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->shared_raw[idx]);
             else
-                return -EINVAL;
+                mfn = mfn_x(INVALID_MFN);
         }
 
-        d->arch.grant_table_gfn[idx] = gfn;
+        if ( mfn != mfn_x(INVALID_MFN) )
+        {
+            d->arch.grant_table_gfn[idx] = gfn;
 
-        t = p2m_ram_rw;
+            t = p2m_ram_rw;
+        }
 
         grant_write_unlock(d->grant_table);
+
+        if ( mfn == mfn_x(INVALID_MFN) )
+            return -EINVAL;
+
         break;
     case XENMAPSPACE_shared_info:
         if ( idx != 0 )