From: Jan Beulich Date: Tue, 8 Dec 2015 13:01:43 +0000 (+0100) Subject: memory: fix XENMEM_exchange error handling X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~2124 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=eedecb3cf0b2ce1ffc2eb08f3c73f88d42c382c9;p=xen.git memory: fix XENMEM_exchange error handling assign_pages() can fail due to the domain getting killed in parallel, which should not result in a hypervisor crash. Reported-by: Julien Grall Also delete a redundant put_gfn() - all relevant paths leading to the "fail" label already do this (and there are also paths where it was plain wrong). All of the put_gfn()-s got introduced by 51032ca058 ("Modify naming of queries into the p2m"), including the otherwise unneeded initializer for k (with even a kind of misleading comment - the compiler warning could actually have served as a hint that the use is wrong). This is CVE-2015-8339 + CVE-2015-8340 / XSA-159. Signed-off-by: Jan Beulich Acked-by: Ian Campbell --- diff --git a/xen/common/memory.c b/xen/common/memory.c index e00a0b2797..b6bf543fe9 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -378,7 +378,7 @@ static long memory_exchange(XEN_GUEST_HANDLE_PARAM(xen_memory_exchange_t) arg) PAGE_LIST_HEAD(out_chunk_list); unsigned long in_chunk_order, out_chunk_order; xen_pfn_t gpfn, gmfn, mfn; - unsigned long i, j, k = 0; /* gcc ... */ + unsigned long i, j, k; unsigned int memflags = 0; long rc = 0; struct domain *d; @@ -610,11 +610,12 @@ static long memory_exchange(XEN_GUEST_HANDLE_PARAM(xen_memory_exchange_t) arg) fail: /* Reassign any input pages we managed to steal. */ while ( (page = page_list_remove_head(&in_chunk_list)) ) - { - put_gfn(d, gmfn + k--); if ( assign_pages(d, page, 0, MEMF_no_refcount) ) - BUG(); - } + { + BUG_ON(!d->is_dying); + if ( test_and_clear_bit(_PGC_allocated, &page->count_info) ) + put_page(page); + } dying: rcu_unlock_domain(d);