arm: handle races between relinquish_memory and free_domheap_pages
authorIan Campbell <ian.campbell@citrix.com>
Thu, 29 Oct 2015 12:47:38 +0000 (13:47 +0100)
committerIan Campbell <ijc@debian.org>
Tue, 9 Feb 2016 16:41:16 +0000 (16:41 +0000)
commitfc12722ee7c5fc2e776c768e2c9fbb10586d61a1
tree4aa46b82e58e5fd009655fd1e1777b4bc2221ffa
parente7c3a0a783124169045135846f7b7c627e95cbf8
arm: handle races between relinquish_memory and free_domheap_pages

Primarily this means XENMEM_decrease_reservation from a toolstack
domain.

Unlike x86 we have no requirement right now to queue such pages onto
a separate list, if we hit this race then the other code has already
fully accepted responsibility for freeing this page and therefore
there is no more for relinquish_memory to do.

This is CVE-2015-7814 / XSA-147.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Reviewed-by: Julien Grall <julien.grall@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
master commit: 1ef01396fdff88b1c3331a09ca5c69619b90f4ea
master date: 2015-10-29 13:34:17 +0100

(cherry picked from commit df6fa370865717ee51530c0102d1e983a70d37c3)

Patch-Name: CVE-2015-7814.diff

Gbp-Pq: Name CVE-2015-7814.diff
xen/arch/arm/domain.c