[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen staging] gnttab: correct locking on transitive grant copy error path
commit 6e3aab858eef614a21a782a3b73acc88e74690ea Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Tue Oct 11 14:29:30 2022 +0200 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Tue Oct 11 14:29:30 2022 +0200 gnttab: correct locking on transitive grant copy error path While the comment next to the lock dropping in preparation of recursively calling acquire_grant_for_copy() mistakenly talks about the rd == td case (excluded a few lines further up), the same concerns apply to the calling of release_grant_for_copy() on a subsequent error path. This is CVE-2022-33748 / XSA-411. Fixes: ad48fb963dbf ("gnttab: fix transitive grant handling") Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> --- xen/common/grant_table.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index fba329dcc2..ee7cc496b8 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2622,9 +2622,8 @@ acquire_grant_for_copy( trans_domid); /* - * acquire_grant_for_copy() could take the lock on the - * remote table (if rd == td), so we have to drop the lock - * here and reacquire. + * acquire_grant_for_copy() will take the lock on the remote table, + * so we have to drop the lock here and reacquire. */ active_entry_release(act); grant_read_unlock(rgt); @@ -2661,11 +2660,25 @@ acquire_grant_for_copy( act->trans_gref != trans_gref || !act->is_sub_page)) ) { + /* + * Like above for acquire_grant_for_copy() we need to drop and then + * re-acquire the locks here to prevent lock order inversion issues. + * Unlike for acquire_grant_for_copy() we don't need to re-check + * anything, as release_grant_for_copy() doesn't depend on the grant + * table entry: It only updates internal state and the status flags. + */ + active_entry_release(act); + grant_read_unlock(rgt); + release_grant_for_copy(td, trans_gref, readonly); rcu_unlock_domain(td); + + grant_read_lock(rgt); + act = active_entry_acquire(rgt, gref); reduce_status_for_pin(rd, act, status, readonly); active_entry_release(act); grant_read_unlock(rgt); + put_page(*page); *page = NULL; return ERESTART; -- generated by git-patchbot for /home/xen/git/xen.git#staging
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |