[xen stable-4.13] xen/gnttab: Fix error path in map_grant_ref()

[patchbot@xxxxxxx]

commit d91d4fe88146bb4cf8e66819b6c1b762ce0ac6fc
Author:     Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
AuthorDate: Tue Apr 14 14:51:45 2020 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Apr 14 14:51:45 2020 +0200

    xen/gnttab: Fix error path in map_grant_ref()
    
    Part of XSA-295 (c/s 863e74eb2cffb) inadvertently re-positioned the 
brackets,
    changing the logic.  If the _set_status() call fails, the grant_map 
hypercall
    would fail with a status of 1 (rc != GNTST_okay) instead of the expected
    negative GNTST_* error.
    
    This error path can be taken due to bad guest state, and causes net/blk-back
    in Linux to crash.
    
    This is XSA-316.
    
    Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Julien Grall <jgrall@xxxxxxxxxx>
    master commit: da0c66c8f48042a0186799014af69db0303b1da5
    master date: 2020-04-14 14:41:02 +0200
---
 xen/common/grant_table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5536d282b9..ce0ad578e3 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -1032,7 +1032,7 @@ map_grant_ref(
     {
         if ( (rc = _set_status(shah, status, rd, rgt->gt_version, act,
                                op->flags & GNTMAP_readonly, 1,
-                               ld->domain_id) != GNTST_okay) )
+                               ld->domain_id)) != GNTST_okay )
             goto act_release_out;
 
         if ( !act->pin )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.13