xen/gnttab: Fix error path in map_grant_ref()
authorRoss Lagerwall <ross.lagerwall@citrix.com>
Tue, 14 Apr 2020 12:41:02 +0000 (14:41 +0200)
committerJan Beulich <jbeulich@suse.com>
Tue, 14 Apr 2020 12:41:02 +0000 (14:41 +0200)
commitda0c66c8f48042a0186799014af69db0303b1da5
treeaf5b8fa88fae270b4b4c22a51f2f478dd5b87492
parent6890a04072e664c25447a297fe663b45ecfd6398
xen/gnttab: Fix error path in map_grant_ref()

Part of XSA-295 (c/s 863e74eb2cffb) inadvertently re-positioned the brackets,
changing the logic.  If the _set_status() call fails, the grant_map hypercall
would fail with a status of 1 (rc != GNTST_okay) instead of the expected
negative GNTST_* error.

This error path can be taken due to bad guest state, and causes net/blk-back
in Linux to crash.

This is XSA-316.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
xen/common/grant_table.c