[Xen-changelog] [xen stable-4.5] x86/HVM: prevent use-after-free when destroying a domain

[patchbot@xxxxxxx]

commit d3c151fd3a4365fc6107198bfc975807d40d157d
Author:     Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
AuthorDate: Tue Jan 6 12:49:52 2015 +0000
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Tue Jan 6 12:50:44 2015 +0000

    x86/HVM: prevent use-after-free when destroying a domain

    hvm_domain_relinquish_resources() can free certain domain resources
    which can still be accessed, e.g. by HVMOP_set_param, while the domain
    is being cleaned up.

    This is CVE-2015-0361 / XSA-116.

    Signed-off-by: Mihai DonÈ?u <mdontu@xxxxxxxxxxxxxxx>
    Tested-by: RÄ?zvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/hvm/hvm.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index bc414ff..72be5b9 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1487,9 +1487,6 @@ int hvm_domain_initialise(struct domain *d)

 void hvm_domain_relinquish_resources(struct domain *d)
 {
-    xfree(d->arch.hvm_domain.io_handler);
-    xfree(d->arch.hvm_domain.params);
-
     if ( is_pvh_domain(d) )
         return;

@@ -1511,6 +1508,9 @@ void hvm_domain_relinquish_resources(struct domain *d)

 void hvm_domain_destroy(struct domain *d)
 {
+    xfree(d->arch.hvm_domain.io_handler);
+    xfree(d->arch.hvm_domain.params);
+
     hvm_destroy_cacheattr_region_list(d);

     if ( is_pvh_domain(d) )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog