From: Jan Beulich Date: Tue, 14 Apr 2020 12:42:32 +0000 (+0200) Subject: gnttab: fix GNTTABOP_copy continuation handling X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~405 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=d6f22d5d9e8d6848ec229083ac9fb044f0adea93;p=xen.git gnttab: fix GNTTABOP_copy continuation handling The XSA-226 fix was flawed - the backwards transformation on rc was done too early, causing a continuation to not get invoked when the need for preemption was determined at the very first iteration of the request. This in particular means that all of the status fields of the individual operations would be left untouched, i.e. set to whatever the caller may or may not have initialized them to. This is part of XSA-318. Reported-by: Pawel Wieczorkiewicz Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Tested-by: Pawel Wieczorkiewicz --- diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 4b5344dc21..96080b3dec 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -3576,8 +3576,7 @@ do_grant_table_op( rc = gnttab_copy(copy, count); if ( rc > 0 ) { - rc = count - rc; - guest_handle_add_offset(copy, rc); + guest_handle_add_offset(copy, count - rc); uop = guest_handle_cast(copy, void); } break; @@ -3644,6 +3643,9 @@ do_grant_table_op( out: if ( rc > 0 || opaque_out != 0 ) { + /* Adjust rc, see gnttab_copy() for why this is needed. */ + if ( cmd == GNTTABOP_copy ) + rc = count - rc; ASSERT(rc < count); ASSERT((opaque_out & GNTTABOP_CMD_MASK) == 0); rc = hypercall_create_continuation(__HYPERVISOR_grant_table_op, "ihi",