[Xen-changelog] [xen stable-4.3] AMD/microcode: avoid use-after-free for the microcode buffer

[patchbot@xxxxxxx]

commit de91b853fab7201e502f75aa01e6b3e4ec51d8a4
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Fri Jan 10 11:10:48 2014 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Jan 10 11:10:48 2014 +0100

    AMD/microcode: avoid use-after-free for the microcode buffer
    
    It is possible to free the mc_old buffer and then store it for use in the 
case
    of resume.
    
    This keeps the old semantics of being able to return an error even after a
    successful microcode application.
    
    Coverity-ID 1146953
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
    master commit: a9fe8c7dda440b84e178d65dcd64c0173b0a4b5d
    master date: 2014-01-07 14:58:35 +0100
---
 xen/arch/x86/microcode_amd.c |   17 +++++++++--------
 1 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/xen/arch/x86/microcode_amd.c b/xen/arch/x86/microcode_amd.c
index a3ceef8..3014245 100644
--- a/xen/arch/x86/microcode_amd.c
+++ b/xen/arch/x86/microcode_amd.c
@@ -275,7 +275,7 @@ static int cpu_request_microcode(int cpu, const void *buf, 
size_t bufsize)
     struct microcode_amd *mc_amd, *mc_old;
     size_t offset = bufsize;
     size_t last_offset, applied_offset = 0;
-    int error = 0;
+    int error = 0, save_error = 1;
     struct ucode_cpu_info *uci = &per_cpu(ucode_cpu_info, cpu);
 
     /* We should bind the task to the CPU */
@@ -338,19 +338,20 @@ static int cpu_request_microcode(int cpu, const void 
*buf, size_t bufsize)
      */
     if ( applied_offset )
     {
-        int ret = get_ucode_from_buffer_amd(mc_amd, buf, bufsize,
-                                            &applied_offset);
-        if ( ret == 0 )
-            xfree(mc_old);
-        else
-            error = ret;
+        save_error = get_ucode_from_buffer_amd(
+            mc_amd, buf, bufsize, &applied_offset);
+
+        if ( save_error )
+            error = save_error;
     }
 
-    if ( !applied_offset || error )
+    if ( save_error )
     {
         xfree(mc_amd);
         uci->mc.mc_amd = mc_old;
     }
+    else
+        xfree(mc_old);
 
   out:
     svm_host_osvw_init();
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog