File 5e95afb8-gnttab-fix-GNTTABOP_copy-continuation-... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 5e95afb8-gnttab-fix-GNTTABOP_copy-continuation-handling.patch of Package xen (Revision 91480e636ae5839052648869cbb68e29)

Currently displaying revision 91480e636ae5839052648869cbb68e29 , Show latest

Subject: gnttab: fix GNTTABOP_copy continuation handling
From: Jan Beulich jbeulich@suse.com Tue Apr 14 14:42:32 2020 +0200
Date: Tue Apr 14 14:42:32 2020 +0200:
Git: d6f22d5d9e8d6848ec229083ac9fb044f0adea93

The XSA-226 fix was flawed - the backwards transformation on rc was done
too early, causing a continuation to not get invoked when the need for
preemption was determined at the very first iteration of the request.
This in particular means that all of the status fields of the individual
operations would be left untouched, i.e. set to whatever the caller may
or may not have initialized them to.

This is part of XSA-318.

Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Tested-by: Pawel Wieczorkiewicz <wipawel@amazon.de>

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 4b5344dc21..96080b3dec 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3583,8 +3583,7 @@ do_grant_table_op(
         rc = gnttab_copy(copy, count);
         if ( rc > 0 )
         {
-            rc = count - rc;
-            guest_handle_add_offset(copy, rc);
+            guest_handle_add_offset(copy, count - rc);
             uop = guest_handle_cast(copy, void);
         }
         break;
@@ -3651,6 +3650,9 @@ do_grant_table_op(
   out:
     if ( rc > 0 || opaque_out != 0 )
     {
+        /* Adjust rc, see gnttab_copy() for why this is needed. */
+        if ( cmd == GNTTABOP_copy )
+            rc = count - rc;
         ASSERT(rc < count);
         ASSERT((opaque_out & GNTTABOP_CMD_MASK) == 0);
         rc = hypercall_create_continuation(__HYPERVISOR_grant_table_op, "ihi",

Places

File 5e95afb8-gnttab-fix-GNTTABOP_copy-continuation-handling.patch of Package xen (Revision 91480e636ae5839052648869cbb68e29)

Places