[Xen-changelog] [xen stable-4.2] x86/HVM: prevent use-after-free when destroying a domain

[patchbot@xxxxxxx]

commit 95af3f09eeef089e0100a8518f7ca75206e33c7c
Author:     Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
AuthorDate: Tue Jan 6 12:52:21 2015 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Tue Jan 6 12:52:41 2015 +0000

    x86/HVM: prevent use-after-free when destroying a domain

    hvm_domain_relinquish_resources() can free certain domain resources
    which can still be accessed, e.g. by HVMOP_set_param, while the domain
    is being cleaned up.

    Signed-off-by: Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
    Tested-by: RÄ?zvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>

    This is CVE-2015-0361 / XSA-116.
    (cherry picked from commit 5d4e3ff19c33770ce01bec949c50326b11088fef)
---
 xen/arch/x86/hvm/hvm.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 4be249e..dcac4ad 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -579,13 +579,13 @@ void hvm_domain_relinquish_resources(struct domain *d)
         hpet_deinit(d);
     }

-    xfree(d->arch.hvm_domain.io_handler);
-    xfree(d->arch.hvm_domain.params);
     xfree(d->arch.hvm_domain.pbuf);
 }

 void hvm_domain_destroy(struct domain *d)
 {
+    xfree(d->arch.hvm_domain.io_handler);
+    xfree(d->arch.hvm_domain.params);
     hvm_funcs.domain_destroy(d);
     rtc_deinit(d);
     stdvga_deinit(d);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.2

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog