xen/netfront: don't use gnttab_query_foreign_access() for mapped status
authorJuergen Gross <jgross@suse.com>
Mon, 7 Mar 2022 08:48:54 +0000 (09:48 +0100)
committerJuergen Gross <jgross@suse.com>
Mon, 7 Mar 2022 08:48:54 +0000 (09:48 +0100)
commit31185df7e2b1d2fa1de4900247a12d7b9c7087eb
treeda3daf6834b4aed5d6ea01feb1ec934a0488dc9b
parentabf1fd5919d6238ee3bc5eb4a9b6c3947caa6638
xen/netfront: don't use gnttab_query_foreign_access() for mapped status

It isn't enough to check whether a grant is still being in use by
calling gnttab_query_foreign_access(), as a mapping could be realized
by the other side just after having called that function.

In case the call was done in preparation of revoking a grant it is
better to do so via gnttab_end_foreign_access_ref() and check the
success of that operation instead.

This is CVE-2022-23037 / part of XSA-396.

Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
V2:
- use gnttab_try_end_foreign_access()
V3:
- don't use gnttab_try_end_foreign_access()
drivers/net/xen-netfront.c