From: Ross Lagerwall Date: Tue, 14 Apr 2020 12:41:02 +0000 (+0200) Subject: xen/gnttab: Fix error path in map_grant_ref() X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~406 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=da0c66c8f48042a0186799014af69db0303b1da5;p=xen.git xen/gnttab: Fix error path in map_grant_ref() Part of XSA-295 (c/s 863e74eb2cffb) inadvertently re-positioned the brackets, changing the logic. If the _set_status() call fails, the grant_map hypercall would fail with a status of 1 (rc != GNTST_okay) instead of the expected negative GNTST_* error. This error path can be taken due to bad guest state, and causes net/blk-back in Linux to crash. This is XSA-316. Signed-off-by: Ross Lagerwall Reviewed-by: Andrew Cooper Reviewed-by: Julien Grall --- diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 9fd6e60416..4b5344dc21 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -1031,7 +1031,7 @@ map_grant_ref( { if ( (rc = _set_status(shah, status, rd, rgt->gt_version, act, op->flags & GNTMAP_readonly, 1, - ld->domain_id) != GNTST_okay) ) + ld->domain_id)) != GNTST_okay ) goto act_release_out; if ( !act->pin )