Linux: error handling issues in blkback's grant mapping

ISSUE DESCRIPTION

To service requests, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn’t mapped. In another case internal state would be insufficiently updated, preventing safe recovery from the error.

IMPACT

A malicious or buggy frontend driver may be able to crash the corresponding backend driver, potentially affecting the entire domain running the backend driver. In configurations without driver domains or similar disaggregation, that is a host-wide denial of sevice.
Privilege escalation and information leaks cannot be ruled out.

VULNERABLE SYSTEMS

Linux versions from at least 3.11 onwards are vulnerable.