[Xen-changelog] [xen stable-4.4] x86/HVM: prevent use-after-free when destroying a domain

[patchbot@xxxxxxx]

commit 089dd62211042011e26de1b87b558394cdfe388b
Author:     Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
AuthorDate: Tue Jan 6 12:49:52 2015 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Tue Jan 6 12:51:37 2015 +0000

    x86/HVM: prevent use-after-free when destroying a domain

    hvm_domain_relinquish_resources() can free certain domain resources
    which can still be accessed, e.g. by HVMOP_set_param, while the domain
    is being cleaned up.

    This is CVE-2015-0361 / XSA-116.

    Signed-off-by: Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
    Tested-by: RÄ?zvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    (cherry picked from commit d3c151fd3a4365fc6107198bfc975807d40d157d)
---
 xen/arch/x86/hvm/hvm.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 84efe48..86ae18a 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -625,9 +625,6 @@ int hvm_domain_initialise(struct domain *d)

 void hvm_domain_relinquish_resources(struct domain *d)
 {
-    xfree(d->arch.hvm_domain.io_handler);
-    xfree(d->arch.hvm_domain.params);
-
     if ( is_pvh_domain(d) )
         return;

@@ -650,6 +647,9 @@ void hvm_domain_relinquish_resources(struct domain *d)

 void hvm_domain_destroy(struct domain *d)
 {
+    xfree(d->arch.hvm_domain.io_handler);
+    xfree(d->arch.hvm_domain.params);
+
     hvm_destroy_cacheattr_region_list(d);

     if ( is_pvh_domain(d) )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog