From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Wed, 1 Apr 2015 09:08:33 +0000 (+0100)
Subject: domctl: don't allow a toolstack domain to call domain_pause() on itself
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~3481
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=131a0ea637e323b1adc5f076165f349612298afa;p=xen.git

domctl: don't allow a toolstack domain to call domain_pause() on itself

These DOMCTL subops were accidentally declared safe for disaggregation
in the wake of XSA-77.

This is XSA-127 / CVE-2015-2751.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 6bcdb98c1e..32d3fcd277 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -886,6 +886,10 @@ long arch_do_domctl(
     {
         xen_guest_tsc_info_t info;
 
+        ret = -EINVAL;
+        if ( d == current->domain ) /* no domain_pause() */
+            break;
+
         domain_pause(d);
         tsc_get_info(d, &info.tsc_mode,
                         &info.elapsed_nsec,
@@ -901,6 +905,10 @@ long arch_do_domctl(
 
     case XEN_DOMCTL_settscinfo:
     {
+        ret = -EINVAL;
+        if ( d == current->domain ) /* no domain_pause() */
+            break;
+
         domain_pause(d);
         tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode,
                      domctl->u.tsc_info.info.elapsed_nsec,
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index c2e60a7d6f..c8bcb2d32b 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -531,7 +531,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
         break;
 
     case XEN_DOMCTL_resumedomain:
-        domain_resume(d);
+        if ( d == current->domain ) /* no domain_pause() */
+            ret = -EINVAL;
+        else
+            domain_resume(d);
         break;
 
     case XEN_DOMCTL_createdomain: