[prev in list] [next in list] [prev in thread] [next in thread]
List: xen-cvs
Subject: [Xen-changelog] [xen stable-4.4] domctl: don't allow a toolstack domain to call domain_pause() on it
From: patchbot () xen ! org
Date: 2015-04-17 11:22:23
Message-ID: E1Yj4Ln-00074E-KM () xenbits ! xen ! org
[Download RAW message or body]
commit 6b09a29ced2e7fc449a39f513e1d8c2b10d2af6d
Author: Andrew Cooper <andrew.cooper3@citrix.com>
AuthorDate: Wed Apr 1 10:10:31 2015 +0100
Commit: Ian Campbell <ian.campbell@citrix.com>
CommitDate: Wed Apr 1 10:14:42 2015 +0100
domctl: don't allow a toolstack domain to call domain_pause() on itself
These DOMCTL subops were accidentally declared safe for disaggregation
in the wake of XSA-77.
This is XSA-127 / CVE-2015-2751.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---
xen/arch/x86/domctl.c | 8 ++++++++
xen/common/domctl.c | 6 ++++--
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index ea76a4f..f01771d 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -960,6 +960,10 @@ long arch_do_domctl(
{
xen_guest_tsc_info_t info;
+ ret = -EINVAL;
+ if ( d == current->domain ) /* no domain_pause() */
+ break;
+
domain_pause(d);
tsc_get_info(d, &info.tsc_mode,
&info.elapsed_nsec,
@@ -975,6 +979,10 @@ long arch_do_domctl(
case XEN_DOMCTL_settscinfo:
{
+ ret = -EINVAL;
+ if ( d == current->domain ) /* no domain_pause() */
+ break;
+
domain_pause(d);
tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode,
domctl->u.tsc_info.info.elapsed_nsec,
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 49e2c23..0e7ad3d 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -396,8 +396,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
case XEN_DOMCTL_resumedomain:
{
- domain_resume(d);
- ret = 0;
+ if ( d == current->domain ) /* no domain_pause() */
+ ret = -EINVAL;
+ else
+ domain_resume(d);
}
break;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4
_______________________________________________
Xen-changelog mailing list
Xen-changelog@lists.xen.org
http://lists.xensource.com/xen-changelog
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic