From: Jan Beulich Date: Fri, 1 Oct 2021 13:05:42 +0000 (+0200) Subject: VT-d: fix deassign of device with RMRR X-Git-Tag: archive/raspbian/4.14.3+32-g9de3671772-1_deb11u1+rpi1^2^2~48^2~31 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ba45e99aa4da5dae6f42819ceb9372764fea410d;p=xen.git VT-d: fix deassign of device with RMRR Ignoring a specific error code here was not meant to short circuit deassign to _just_ the unmapping of RMRRs. This bug was previously hidden by the bogus (potentially indefinite) looping in pci_release_devices(), until f591755823a7 ("IOMMU/PCI: don't let domain cleanup continue when device de-assignment failed") fixed that loop. This is CVE-2021-28702 / XSA-386. Fixes: 8b99f4400b69 ("VT-d: fix RMRR related error handling") Reported-by: Ivan Kardykov Signed-off-by: Jan Beulich Tested-by: Ivan Kardykov (cherry picked from commit 24ebe875a77833696bbe5c9372e9e1590a7e7101) --- diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index ab3c5c1845..4f6bb996d0 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -2408,7 +2408,7 @@ static int reassign_device_ownership( ret = iommu_identity_mapping(source, p2m_access_x, rmrr->base_address, rmrr->end_address, 0); - if ( ret != -ENOENT ) + if ( ret && ret != -ENOENT ) return ret; } }