[xen staging-4.13] VT-d: fix deassign of device with RMRR

[patchbot@xxxxxxx]

commit b4bb02d5999a56c93f0733b589b717e7cece9c09
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Oct 1 15:05:42 2021 +0200
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Oct 5 19:49:12 2021 +0100

    VT-d: fix deassign of device with RMRR
    
    Ignoring a specific error code here was not meant to short circuit
    deassign to _just_ the unmapping of RMRRs. This bug was previously
    hidden by the bogus (potentially indefinite) looping in
    pci_release_devices(), until f591755823a7 ("IOMMU/PCI: don't let domain
    cleanup continue when device de-assignment failed") fixed that loop.
    
    This is CVE-2021-28702 / XSA-386.
    
    Fixes: 8b99f4400b69 ("VT-d: fix RMRR related error handling")
    Reported-by: Ivan Kardykov <kardykov@xxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Tested-by: Ivan Kardykov <kardykov@xxxxxxxxx>
    (cherry picked from commit 24ebe875a77833696bbe5c9372e9e1590a7e7101)
---
 xen/drivers/passthrough/vtd/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/drivers/passthrough/vtd/iommu.c 
b/xen/drivers/passthrough/vtd/iommu.c
index 98787ce3a8..af8b9ca0e4 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2393,7 +2393,7 @@ static int reassign_device_ownership(
                 ret = iommu_identity_mapping(source, p2m_access_x,
                                              rmrr->base_address,
                                              rmrr->end_address, 0);
-                if ( ret != -ENOENT )
+                if ( ret && ret != -ENOENT )
                     return ret;
             }
     }
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.13