File 5c7e70ff-x86-mm-dont-retain-page-typeref-on-IOM... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 5c7e70ff-x86-mm-dont-retain-page-typeref-on-IOMMU-fail.patch of Package xen (Revision 32c66e2a7e6b1648f2747f3d0ae55290)

Currently displaying revision 32c66e2a7e6b1648f2747f3d0ae55290 , Show latest

# Commit fad0de986220c46e70be2f83279961aad7394af0
# Date 2019-03-05 13:52:15 +0100
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86/mm: don't retain page type reference when IOMMU operation fails

The IOMMU update in _get_page_type() happens between recording of the
new reference and validation of the page for its new type (if
necessary). If the IOMMU operation fails, there's no point in actually
carrying out validation. Furthermore, with this resulting in failure
getting indicated to the caller, the recorded type reference also needs
to be dropped again.

Note that in case of failure of alloc_page_type() there's no need to
undo the IOMMU operation: Only special types get handed to the function.
The function, upon failure, clears ->u.inuse.type_info, effectively
converting the page to PGT_none. The IOMMU mapping, however, solely
depends on whether the type is PGT_writable_page.

This is XSA-291.

Reported-by: Igor Druzhinin <igor.druzhinin@citrix.com>
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3037,6 +3037,13 @@ static int __get_page_type(struct page_i
                 iommu_ret = iommu_map_page(d, mfn_to_gmfn(d, page_to_mfn(page)),
                                            page_to_mfn(page),
                                            IOMMUF_readable|IOMMUF_writable);
+
+            if ( unlikely(iommu_ret) )
+            {
+                _put_page_type(page, false, NULL);
+                rc = iommu_ret;
+                goto out;
+            }
         }
     }
 
@@ -3051,12 +3058,10 @@ static int __get_page_type(struct page_i
         rc = alloc_page_type(page, type, preemptible);
     }
 
+ out:
     if ( (x & PGT_partial) && !(nx & PGT_partial) )
         put_page(page);
 
-    if ( !rc )
-        rc = iommu_ret;
-
     return rc;
 }

Places

File 5c7e70ff-x86-mm-dont-retain-page-typeref-on-IOMMU-fail.patch of Package xen (Revision 32c66e2a7e6b1648f2747f3d0ae55290)

Places