From: Keir Fraser <keir@xensource.com>
Date: Thu, 1 Nov 2007 16:34:43 +0000 (+0000)
Subject: Fix use-after-free in xenconsoled.
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~14822^2
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ed8c66a1f64e03aa0c28a599b785976b8f894ea2;p=xen.git

Fix use-after-free in xenconsoled.

shutdown_domain() MUST NOT call cleanup_domain(), just flagging them
as dead is enough.  cleanup_domains() for dead domains is called by
the main loop in handle_io() in a safe way already.

shutdown_domain() calling cleanup_domain() too leads struct domain
being accessed after freeing and to a double-free.

Fixed by simply dropping the cleanup_domain() call and by making the
functions called by the main loop in handle_io() ignore dead domains.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---

diff --git a/tools/console/daemon/io.c b/tools/console/daemon/io.c
index 87b45cb9bd..b699384780 100644
--- a/tools/console/daemon/io.c
+++ b/tools/console/daemon/io.c
@@ -628,7 +628,6 @@ static void shutdown_domain(struct domain *d)
 	if (d->xce_handle != -1)
 		xc_evtchn_close(d->xce_handle);
 	d->xce_handle = -1;
-	cleanup_domain(d);
 }
 
 void enum_domains(void)
@@ -674,6 +673,9 @@ static void handle_tty_read(struct domain *dom)
 	struct xencons_interface *intf = dom->interface;
 	XENCONS_RING_IDX prod;
 
+	if (dom->is_dead)
+		return;
+
 	len = ring_free_bytes(dom);
 	if (len == 0)
 		return;
@@ -711,6 +713,9 @@ static void handle_tty_write(struct domain *dom)
 {
 	ssize_t len;
 
+	if (dom->is_dead)
+		return;
+
 	len = write(dom->tty_fd, dom->buffer.data + dom->buffer.consumed,
 		    dom->buffer.size - dom->buffer.consumed);
  	if (len < 1) {
@@ -734,6 +739,9 @@ static void handle_ring_read(struct domain *dom)
 {
 	evtchn_port_or_error_t port;
 
+	if (dom->is_dead)
+		return;
+
 	if ((port = xc_evtchn_pending(dom->xce_handle)) == -1)
 		return;