xen/26095-SVM-nested-leak.patch
Charles Arnold 646cd8897b - bnc#777628 - guest "disappears" after live migration
Updated block-dmmd script

- fate#310510 - fix xenpaging
  restore changes to integrate paging into xm/xend
  xenpaging.autostart.patch
  xenpaging.doc.patch

- bnc#787163 - VUL-0: CVE-2012-4544: xen: Domain builder Out-of-
  memory due to malicious kernel/ramdisk (XSA 25)
  CVE-2012-4544-xsa25.patch
- bnc#779212 - VUL-0: CVE-2012-4411: XEN / qemu: guest
  administrator can access qemu monitor console (XSA-19)
  CVE-2012-4411-xsa19.patch

- bnc#786516 - VUL-0: CVE-2012-4535: xen: Timer overflow DoS
  vulnerability
  CVE-2012-4535-xsa20.patch
- bnc#786518 - VUL-0: CVE-2012-4536: xen: pirq range check DoS
  vulnerability
  CVE-2012-4536-xsa21.patch
- bnc#786517 - VUL-0: CVE-2012-4537: xen: Memory mapping failure
  DoS vulnerability
  CVE-2012-4537-xsa22.patch
- bnc#786519 - VUL-0: CVE-2012-4538: xen: Unhooking empty PAE
  entries DoS vulnerability
  CVE-2012-4538-xsa23.patch
- bnc#786520 - VUL-0: CVE-2012-4539: xen: Grant table hypercall
  infinite loop DoS vulnerability
  CVE-2012-4539-xsa24.patch

OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=212
2012-11-19 13:58:33 +00:00

33 lines
1.2 KiB
Diff

# HG changeset patch
# User Christoph Egger <Christoph.Egger@amd.com>
# Date 1350976407 -7200
# Node ID a7503ce27d462056421c6d74737cee08ab4ae31e
# Parent c69bcb24812896dc6d5cf033babb7e79b8a50aec
nestedsvm: fix memory leak on shutdown/crash
Fix memory leak of l1 vmcb page when destroying a vcpu while l2 guest
is running.
Signed-off-by: Christoph Egger <Christoph.Egger@amd.com>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -122,6 +122,15 @@ void nsvm_vcpu_destroy(struct vcpu *v)
struct nestedvcpu *nv = &vcpu_nestedhvm(v);
struct nestedsvm *svm = &vcpu_nestedsvm(v);
+ /*
+ * When destroying the vcpu, it may be running on behalf of l2 guest.
+ * Therefore we need to switch the VMCB pointer back to the l1 vmcb,
+ * in order to avoid double free of l2 vmcb and the possible memory leak
+ * of l1 vmcb page.
+ */
+ if (nv->nv_n1vmcx)
+ v->arch.hvm_svm.vmcb = nv->nv_n1vmcx;
+
if (svm->ns_cached_msrpm) {
free_xenheap_pages(svm->ns_cached_msrpm,
get_order_from_bytes(MSRPM_SIZE));