VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerability
authorIan Jackson <Ian.Jackson@eu.citrix.com>
Wed, 14 Nov 2012 11:30:34 +0000 (11:30 +0000)
committerIan Jackson <Ian.Jackson@eu.citrix.com>
Wed, 14 Nov 2012 11:30:34 +0000 (11:30 +0000)
commitdfa0cb6a14b3c835e643f56b620137b5aff3e1c1
tree72a632131081ca9f759f9b0a38d333cb5a9bae27
parentb46c24edb7b8acba387b8621f867b7d4c5fce1b3
VCPU/timers: Prevent overflow in calculations, leading to DoS vulnerability

The timer action for a vcpu periodic timer is to calculate the next
expiry time, and to reinsert itself into the timer queue.  If the
deadline ends up in the past, Xen never leaves __do_softirq().  The
affected PCPU will stay in an infinite loop until Xen is killed by the
watchdog (if enabled).

This is a security problem, XSA-20 / CVE-2012-4535.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
xen/common/domain.c
xen/include/xen/time.h