]> xenbits.xensource.com Git - xen.git/commit
passthrough/x86: stop pirq iteration immediately in case of error
authorJulien Grall <jgrall@amazon.com>
Wed, 5 Jan 2022 18:09:20 +0000 (18:09 +0000)
committerJan Beulich <jbeulich@suse.com>
Tue, 25 Jan 2022 12:27:02 +0000 (13:27 +0100)
commit9480a1a519cf016623f657dc544cb372a82b5708
tree75206a5a3304f537eb5a7c08a892c8a1274dc9e8
parent975a8fb45ca186b3476e5656c6ad5dad1122dbfd
passthrough/x86: stop pirq iteration immediately in case of error

pt_pirq_iterate() will iterate in batch over all the PIRQs. The outer
loop will bail out if 'rc' is non-zero but the inner loop will continue.

This means 'rc' will get clobbered and we may miss any errors (such as
-ERESTART in the case of the callback pci_clean_dpci_irq()).

This is CVE-2022-23035 / XSA-395.

Fixes: c24536b636f2 ("replace d->nr_pirqs sized arrays with radix tree")
Fixes: f6dd295381f4 ("dpci: replace tasklet with softirq")
Signed-off-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
xen/drivers/passthrough/x86/hvm.c