[Xen-changelog] [xen stable-4.9] arm/mm: release grant lock on xenmem_add_to_physmap_one() error paths

[patchbot@xxxxxxx]

commit 5ff1de3e4f56b2dd7c5c7dae8b008f6ee6dc2081
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Aug 23 17:51:44 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Aug 23 17:51:44 2017 +0200

    arm/mm: release grant lock on xenmem_add_to_physmap_one() error paths
    
    Commit 55021ff9ab ("xen/arm: add_to_physmap_one: Avoid to map mfn 0 if
    an error occurs") introduced error paths not releasing the grant table
    lock. Replace them by a suitable check after the lock was dropped.
    
    This is XSA-235.
    
    Reported-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Julien Grall <julien.grall@xxxxxxx>
    master commit: 59546c1897a90fe9af5ebbbb05ead8d98b4d17b9
    master date: 2017-08-23 17:45:45 +0200
---
 xen/arch/arm/mm.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index 3371006..ef840ec 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -1164,7 +1164,7 @@ int xenmem_add_to_physmap_one(
             if ( idx < nr_status_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->status[idx]);
             else
-                return -EINVAL;
+                mfn = mfn_x(INVALID_MFN);
         }
         else
         {
@@ -1175,14 +1175,21 @@ int xenmem_add_to_physmap_one(
             if ( idx < nr_grant_frames(d->grant_table) )
                 mfn = virt_to_mfn(d->grant_table->shared_raw[idx]);
             else
-                return -EINVAL;
+                mfn = mfn_x(INVALID_MFN);
         }
 
-        d->arch.grant_table_gfn[idx] = gfn;
+        if ( mfn != mfn_x(INVALID_MFN) )
+        {
+            d->arch.grant_table_gfn[idx] = gfn;
 
-        t = p2m_ram_rw;
+            t = p2m_ram_rw;
+        }
 
         grant_write_unlock(d->grant_table);
+
+        if ( mfn == mfn_x(INVALID_MFN) )
+            return -EINVAL;
+
         break;
     case XENMAPSPACE_shared_info:
         if ( idx != 0 )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog