[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] xen/gnttab: _cache_flush refuse an owner without a grant table
- To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Stefano Stabellini <stefano.stabellini@xxxxxxx>
- Date: Fri, 6 Nov 2026 17:06:23 -0800
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=69fk94kAopaX87SwiE9TUjp1ZYcfe1Qrx/H1fvN4POo=; b=UCGsMrUX7///xhjx58wsUdr85SMYSofXJY/JegOKWsEssUlDPz6gRDipRKaDRHguobOO2ERKp9ZVEm05YA0ntKtILZmSe3IVxoPiOsOTQIGACvCM7rcnrpzhNDwyfNdj2PYW4RtWcdddp3S8/5cTqztON1OTkk3VJD6GqZGWH/PnZXKur8gXh/SzoEyD4IC31npGO1l98KWkW7bcGAxOnKUbn+44OnOQ0E/OH8iMYd7rJoQS1SOPf6B6jqnL31EPRRWy1g16SJ/oq+MtwPx+Q4XQpOB/Nei+mG4VvtHs7qSuh+3ruW3jCcOXperyS/B4JudjzVsYIswCAwy9UPN0mA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=b6wydkhH86m7PcW7J1trOE98Nt1lOzhrT3qFl293SNqprxX0z+1CJeQFk8f4D359zoVaHgkjCWe2hrCAoghgrrJYKq1Zt1/hG8RMTKb7VAvwJIYOaTACANxA+zFoybtutYrLukX38A0N2Kx3OOWi9nZikckTVGd36jS+ds6iUzK7MbJ4CmHSAldAKhgmV6UhYqo2JfFRN/qCgL1ydBkz93IG9ml9xvnyx9kLqXxh6jclP+I3uIVP1U/tFxbgKMzcLMGHLbcd0gHnvfiqvKF8V47nXGL5mzScHn/dwEDvhhaDqGqicWd5hijrBhYUrQkP5OnmO2VmXmlCdYEcbXJ6Fw==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: <stefano.stabellini@xxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Julien Grall <julien@xxxxxxx>, Roger Pau Monne <roger@xxxxxxxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>
- Delivery-date: Sat, 07 Nov 2026 01:06:47 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
With CONFIG_STATIC_SHM, a shared memory region without a "role" is owned
by dom_io. A cache flush on such a page then reaches grant_read_lock()
with dom_io's NULL grant table. Reinstate the check, and give back the
page reference taken by page_get_owner_and_reference().
Fixes: bec8e3c1fb91 ("xen/gnttab: Drop owner->grant_table check in
_cache_flush()")
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
---
xen/common/grant_table.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 2285c4aee8..999b10abcf 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3633,9 +3633,11 @@ static int _cache_flush(gnttab_cache_flush_t *cflush,
grant_ref_t *cur_ref)
page = mfn_to_page(mfn);
owner = page_get_owner_and_reference(page);
- if ( !owner )
+ if ( !owner || !owner->grant_table )
{
rcu_unlock_domain(d);
+ if ( owner )
+ put_page(page);
return -EPERM;
}
--
2.47.3
|
