[Pkg-xen-changes] [xen] 05/08: domctl: don't allow a toolstack domain to call domain_pause() on itself

[Bastian Blank]

This is an automated email from the git hooks/post-receive script.

waldi pushed a commit to branch debian/jessie
in repository xen.

commit acf8774b2176c6a067abfb87ccba4b0e55b50e61
Author: Andrew Cooper <andrew.cooper3 at citrix.com>
Date:   Wed Apr 1 10:10:31 2015 +0100

    domctl: don't allow a toolstack domain to call domain_pause() on itself
    
    These DOMCTL subops were accidentally declared safe for disaggregation
    in the wake of XSA-77.
    
    This is XSA-127 / CVE-2015-2751.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3 at citrix.com>
    Reviewed-by: Jan Beulich <jbeulich at suse.com>
    Acked-by: Ian Campbell <ian.campbell at citrix.com>
    (cherry picked from commit 6b09a29ced2e7fc449a39f513e1d8c2b10d2af6d)
    
    Patch-Name: CVE-2015-2751.diff
---
 xen/arch/x86/domctl.c | 8 ++++++++
 xen/common/domctl.c   | 6 ++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index ea76a4f..f01771d 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -960,6 +960,10 @@ long arch_do_domctl(
     {
         xen_guest_tsc_info_t info;
 
+        ret = -EINVAL;
+        if ( d == current->domain ) /* no domain_pause() */
+            break;
+
         domain_pause(d);
         tsc_get_info(d, &info.tsc_mode,
                         &info.elapsed_nsec,
@@ -975,6 +979,10 @@ long arch_do_domctl(
 
     case XEN_DOMCTL_settscinfo:
     {
+        ret = -EINVAL;
+        if ( d == current->domain ) /* no domain_pause() */
+            break;
+
         domain_pause(d);
         tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode,
                      domctl->u.tsc_info.info.elapsed_nsec,
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 060af1b..022940c 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -395,8 +395,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 
     case XEN_DOMCTL_resumedomain:
     {
-        domain_resume(d);
-        ret = 0;
+        if ( d == current->domain ) /* no domain_pause() */
+            ret = -EINVAL;
+        else
+            domain_resume(d);
     }
     break;
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-xen/xen.git