[xen stable-4.8] grant_table: fix GNTTABOP_cache_flush handling

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[xen stable-4.8] grant_table: fix GNTTABOP_cache_flush handling

patchbot
commit e5740469878fc2c2a69b70a3b846c6a9121df34b
Author:     Andrew Cooper <[hidden email]>
AuthorDate: Tue Sep 12 15:06:39 2017 +0200
Commit:     Jan Beulich <[hidden email]>
CommitDate: Tue Sep 12 15:06:39 2017 +0200

    grant_table: fix GNTTABOP_cache_flush handling
   
    Don't fall over a NULL grant_table pointer when the owner of the domain
    is a system domain (DOMID_{XEN,IO} etc).
   
    This is CVE-2017-14318 / XSA-232.
   
    Reported-by: Matthew Daley <[hidden email]>
    Signed-off-by: Andrew Cooper <[hidden email]>
    Reviewed-by: Jan Beulich <[hidden email]>
    master commit: c3d830b244998b3686e2eb64db95996be5eb5e5c
    master date: 2017-09-12 14:44:11 +0200
---
 xen/common/grant_table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5e3678a..288aebf 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3030,7 +3030,7 @@ static int __gnttab_cache_flush(gnttab_cache_flush_t *cflush,
 
     page = mfn_to_page(mfn);
     owner = page_get_owner_and_reference(page);
-    if ( !owner )
+    if ( !owner || !owner->grant_table )
     {
         rcu_unlock_domain(d);
         return -EPERM;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
[hidden email]
https://lists.xenproject.org/xen-changelog