Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE
xen.24553
xsa395.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa395.patch of Package xen.24553
From 743348f5d545c7fff9cdea746840b795f5c26d43 Mon Sep 17 00:00:00 2001 From: Julien Grall <jgrall@amazon.com> Date: Wed, 5 Jan 2022 18:09:39 +0000 Subject: [PATCH] passthrough/x86: pt_pirq_iterate: Don't clobber rc in case of an error pt_pirq_iterate() will iterate in batch over all the PIRQs. The outer loop will bail out if 'rc' is non-zero but the inner loop will continue. This means 'rc' will get clobbered and we may miss any errors (such as -ERESTART in the case of the callback pci_clean_dpci_irq()). This is CVE-2022-23035 / XSA-395. Fixes: c24536b636f2 ("replace d->nr_pirqs sized arrays with radix tree") Fixes: f6dd295381f4 ("dpci: replace tasklet with softirq") Signed-off-by: Julien Grall <jgrall@amazon.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com> --- xen/drivers/passthrough/io.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/drivers/passthrough/io.c b/xen/drivers/passthrough/io.c index 71eaf2c17e27..b6e88ebc8646 100644 --- a/xen/drivers/passthrough/io.c +++ b/xen/drivers/passthrough/io.c @@ -810,7 +810,11 @@ int pt_pirq_iterate(struct domain *d, pirq = pirqs[i]->pirq; if ( (pirq_dpci->flags & HVM_IRQ_DPCI_MAPPED) ) + { rc = cb(d, pirq_dpci, arg); + if ( rc ) + break; + } } } while ( !rc && ++pirq < d->nr_pirqs && n == ARRAY_SIZE(pirqs) ); -- 2.32.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor