CVE-2022-50257: xen/gntdev: Prevent leaking grants

In the Linux kernel, the following vulnerability has been resolved:

xen/gntdev: Prevent leaking grants

Prior to this commit, if a grant mapping operation failed partially, some of the entries in the mapops array would be invalid, whereas all of the entries in the kmapops array would be valid. This in turn would cause the following logic in gntdevmapgrantpages to become invalid:

for (i = 0; i < map->count; i++) { if (map->mapops[i].status == GNTSTokay) { map->unmapops[i].handle = map->mapops[i].handle; if (!useptemod) alloced++; } if (useptemod) { if (map->kmapops[i].status == GNTSTokay) { if (map->mapops[i].status == GNTSTokay) alloced++; map->kunmapops[i].handle = map->kmapops[i].handle; } } } ... atomicadd(alloced, &map->livegrants);

Assume that useptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmapops[i].status and mapops[i].status are set to GNTSTokay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above.

The aforementioned causes map->livegrants to be incorrectly set. In some cases, all of the mapops mappings fail, but all of the kmapops mappings succeed, meaning that livegrants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmapops, because unmapgrantpages has the following snippet of code at its beginning:

if (atomicread(&map->livegrants) == 0) return; / Nothing to do /

In other cases where only some of the mapops mappings fail but all kmapops mappings succeed, livegrants is made positive, but when the user requests unmapping the grant-mapped pages, unmapgrantpagesdone will then make map->livegrants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->livegrants) from map->livegrants. The side effects of a negative livegrants value have not been studied.

The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0).

The fix for this issue involves counting all successful mapops and kmapops mappings separately, and then adding the sum to livegrants. During unmapping, only the number of successfully unmapped grants is subtracted from livegrants. The code is also modified to check for negative livegrants values after the subtraction and warn the user.