File 615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.... of Package xen.24553

Overview Repositories Revisions Requests Users Attributes Meta

File 615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch of Package xen.24553

Subject: VT-d: fix deassign of device with RMRR
From: Jan Beulich jbeulich@suse.com Fri Oct 1 15:05:42 2021 +0200
Date: Tue Oct 5 19:56:16 2021 +0100:
Git: 192aaf7e146c0b41dbdd35ccdb13eb33ced13633

Ignoring a specific error code here was not meant to short circuit
deassign to _just_ the unmapping of RMRRs. This bug was previously
hidden by the bogus (potentially indefinite) looping in
pci_release_devices(), until f591755823a7 ("IOMMU/PCI: don't let domain
cleanup continue when device de-assignment failed") fixed that loop.

This is CVE-2021-28702 / XSA-386.

Fixes: 8b99f4400b69 ("VT-d: fix RMRR related error handling")
Reported-by: Ivan Kardykov <kardykov@tabit.pro>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: Ivan Kardykov <kardykov@tabit.pro>

--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2411,7 +2411,7 @@ static int reassign_device_ownership(
                 ret = iommu_identity_mapping(source, p2m_access_x,
                                              rmrr->base_address,
                                              rmrr->end_address, 0);
-                if ( ret != -ENOENT )
+                if ( ret && ret != -ENOENT )
                     return ret;
             }
     }

Places

File 615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch of Package xen.24553

Places