[Xen-changelog] [xen master] libxc: Protect xc_domain_resume from clobbering domain registers

[patchbot@xxxxxxx]

commit 84acc84afbd1bd859cd31d44831db77da6ade960
Author:     Jason Andryuk <andryuk@xxxxxxxx>
AuthorDate: Tue May 20 09:37:08 2014 -0400
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Wed May 21 13:02:28 2014 +0100

    libxc: Protect xc_domain_resume from clobbering domain registers
    
    xc_domain_resume() expects the guest to be in state SHUTDOWN_suspend.
    However, nothing verifies the state before modify_returncode() modifies
    the domain's registers.  This will crash guest processes or the kernel
    itself.
    
    This can be demonstrated with `LIBXL_SAVE_HELPER=/bin/false xl migrate`.
    
    Signed-off-by: Jason Andryuk <andryuk@xxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 tools/libxc/xc_resume.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/tools/libxc/xc_resume.c b/tools/libxc/xc_resume.c
index 18b4818..e423814 100644
--- a/tools/libxc/xc_resume.c
+++ b/tools/libxc/xc_resume.c
@@ -33,12 +33,21 @@ static int modify_returncode(xc_interface *xch, uint32_t 
domid)
     struct domain_info_context *dinfo = &_dinfo;
     int rc;
 
-    if ( xc_domain_getinfo(xch, domid, 1, &info) != 1 )
+    if ( xc_domain_getinfo(xch, domid, 1, &info) != 1 ||
+         info.domid != domid )
     {
         PERROR("Could not get domain info");
         return -1;
     }
 
+    if ( !info.shutdown || (info.shutdown_reason != SHUTDOWN_suspend) )
+    {
+        ERROR("Dom %d not suspended: (shutdown %d, reason %d)", domid,
+              info.shutdown, info.shutdown_reason);
+        errno = EINVAL;
+        return -1;
+    }
+
     if ( info.hvm )
     {
         /* HVM guests without PV drivers have no return code to modify. */
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog