[Xen-changelog] [xen stable-4.9] x86/mm: don't retain page type reference when IOMMU operation fails

[patchbot@xxxxxxx]

commit 7390fa1223d1d3218232844d82378a085d97b744
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Mar 5 15:29:53 2019 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Mar 5 15:29:53 2019 +0100

    x86/mm: don't retain page type reference when IOMMU operation fails
    
    The IOMMU update in _get_page_type() happens between recording of the
    new reference and validation of the page for its new type (if
    necessary). If the IOMMU operation fails, there's no point in actually
    carrying out validation. Furthermore, with this resulting in failure
    getting indicated to the caller, the recorded type reference also needs
    to be dropped again.
    
    Note that in case of failure of alloc_page_type() there's no need to
    undo the IOMMU operation: Only special types get handed to the function.
    The function, upon failure, clears ->u.inuse.type_info, effectively
    converting the page to PGT_none. The IOMMU mapping, however, solely
    depends on whether the type is PGT_writable_page.
    
    This is XSA-291.
    
    Reported-by: Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: fad0de986220c46e70be2f83279961aad7394af0
    master date: 2019-03-05 13:52:15 +0100
---
 xen/arch/x86/mm.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index a4f7b1f3ad..a7c7d4bd05 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3037,6 +3037,13 @@ static int __get_page_type(struct page_info *page, 
unsigned long type,
                 iommu_ret = iommu_map_page(d, mfn_to_gmfn(d, 
page_to_mfn(page)),
                                            page_to_mfn(page),
                                            IOMMUF_readable|IOMMUF_writable);
+
+            if ( unlikely(iommu_ret) )
+            {
+                _put_page_type(page, false, NULL);
+                rc = iommu_ret;
+                goto out;
+            }
         }
     }
 
@@ -3051,12 +3058,10 @@ static int __get_page_type(struct page_info *page, 
unsigned long type,
         rc = alloc_page_type(page, type, preemptible);
     }
 
+ out:
     if ( (x & PGT_partial) && !(nx & PGT_partial) )
         put_page(page);
 
-    if ( !rc )
-        rc = iommu_ret;
-
     return rc;
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog