diff options
Diffstat (limited to 'system/xen/xsa/xsa235-4.9.patch')
| -rw-r--r-- | system/xen/xsa/xsa235-4.9.patch | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa235-4.9.patch b/system/xen/xsa/xsa235-4.9.patch new file mode 100644 index 0000000000..25dd650755 --- /dev/null +++ b/system/xen/xsa/xsa235-4.9.patch @@ -0,0 +1,49 @@ +From: Jan Beulich <jbeulich@suse.com> +Subject: arm/mm: release grant lock on xenmem_add_to_physmap_one() error paths + +Commit 55021ff9ab ("xen/arm: add_to_physmap_one: Avoid to map mfn 0 if +an error occurs") introduced error paths not releasing the grant table +lock. Replace them by a suitable check after the lock was dropped. + +This is XSA-235. + +Reported-by: Wei Liu <wei.liu2@citrix.com> +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Julien Grall <julien.grall@arm.com> + +--- a/xen/arch/arm/mm.c ++++ b/xen/arch/arm/mm.c +@@ -1164,7 +1164,7 @@ int xenmem_add_to_physmap_one( + if ( idx < nr_status_frames(d->grant_table) ) + mfn = virt_to_mfn(d->grant_table->status[idx]); + else +- return -EINVAL; ++ mfn = mfn_x(INVALID_MFN); + } + else + { +@@ -1175,14 +1175,21 @@ int xenmem_add_to_physmap_one( + if ( idx < nr_grant_frames(d->grant_table) ) + mfn = virt_to_mfn(d->grant_table->shared_raw[idx]); + else +- return -EINVAL; ++ mfn = mfn_x(INVALID_MFN); + } + +- d->arch.grant_table_gfn[idx] = gfn; ++ if ( mfn != mfn_x(INVALID_MFN) ) ++ { ++ d->arch.grant_table_gfn[idx] = gfn; + +- t = p2m_ram_rw; ++ t = p2m_ram_rw; ++ } + + grant_write_unlock(d->grant_table); ++ ++ if ( mfn == mfn_x(INVALID_MFN) ) ++ return -EINVAL; ++ + break; + case XENMAPSPACE_shared_info: + if ( idx != 0 ) |