a11c33863f
5281fad4-numa-sched-leave-node-affinity-alone-if-not-in-auto-mode.patch 52820823-nested-SVM-adjust-guest-handling-of-structure-mappings.patch 52820863-VMX-don-t-crash-processing-d-debug-key.patch 5282492f-x86-eliminate-has_arch_mmios.patch 52864df2-credit-Update-other-parameters-when-setting-tslice_ms.patch 52864f30-fix-leaking-of-v-cpu_affinity_saved-on-domain-destruction.patch 5289d225-nested-VMX-don-t-ignore-mapping-errors.patch 528a0eb0-x86-consider-modules-when-cutting-off-memory.patch 528f606c-x86-hvm-reset-TSC-to-0-after-domain-resume-from-S3.patch 528f609c-x86-crash-disable-the-watchdog-NMIs-on-the-crashing-cpu.patch 52932418-x86-xsave-fix-nonlazy-state-handling.patch - Add missing requires to pciutils package for xend-tools - bnc#851749 - Xen service file does not call xend properly xend.service - bnc#851386 - VUL-0: xen: XSA-78: Insufficient TLB flushing in VT-d (iommu) code 528a0e5b-TLB-flushing-in-dma_pte_clear_one.patch - bnc#849667 - VUL-0: xen: XSA-74: Lock order reversal between page_alloc_lock and mm_rwlock CVE-2013-4553-xsa74.patch - bnc#849665 - VUL-0: CVE-2013-4551: xen: XSA-75: Host crash due to guest VMX instruction execution 52809208-nested-VMX-VMLANUCH-VMRESUME-emulation-must-check-permission-1st.patch - bnc#849668 - VUL-0: xen: XSA-76: Hypercalls exposed to privilege rings 1 and 2 of HVM guests OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=279
102 lines
3.5 KiB
Diff
102 lines
3.5 KiB
Diff
References: bnc#848657 CVE-2013-4494 XSA-73
|
|
|
|
# HG changeset patch
|
|
# User Andrew Cooper <andrew.cooper3@citrix.com>
|
|
# Date 1383556439 -3600
|
|
# Node ID f63cb4c06a991a69b0f11789c88ef069eb39f64c
|
|
# Parent c30539bc5b235c9ce657f483c2305212ad1cdfba
|
|
gnttab: correct locking order reversal
|
|
|
|
Coverity ID 1087189
|
|
|
|
Correct a lock order reversal between a domains page allocation and grant
|
|
table locks.
|
|
|
|
This is CVE-2013-4494 / XSA-73.
|
|
|
|
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
|
|
Consolidate error handling.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Keir Fraser <keir@xen.org>
|
|
Tested-by: Matthew Daley <mattjd@gmail.com>
|
|
|
|
--- a/xen/common/grant_table.c
|
|
+++ b/xen/common/grant_table.c
|
|
@@ -1518,6 +1518,8 @@ gnttab_transfer(
|
|
|
|
for ( i = 0; i < count; i++ )
|
|
{
|
|
+ bool_t okay;
|
|
+
|
|
if (i && hypercall_preempt_check())
|
|
return i;
|
|
|
|
@@ -1626,16 +1628,18 @@ gnttab_transfer(
|
|
* pages when it is dying.
|
|
*/
|
|
if ( unlikely(e->is_dying) ||
|
|
- unlikely(e->tot_pages >= e->max_pages) ||
|
|
- unlikely(!gnttab_prepare_for_transfer(e, d, gop.ref)) )
|
|
+ unlikely(e->tot_pages >= e->max_pages) )
|
|
{
|
|
- if ( !e->is_dying )
|
|
- gdprintk(XENLOG_INFO, "gnttab_transfer: "
|
|
- "Transferee has no reservation "
|
|
- "headroom (%d,%d) or provided a bad grant ref (%08x) "
|
|
- "or is dying (%d)\n",
|
|
- e->tot_pages, e->max_pages, gop.ref, e->is_dying);
|
|
spin_unlock(&e->page_alloc_lock);
|
|
+
|
|
+ if ( e->is_dying )
|
|
+ gdprintk(XENLOG_INFO, "gnttab_transfer: "
|
|
+ "Transferee (d%d) is dying\n", e->domain_id);
|
|
+ else
|
|
+ gdprintk(XENLOG_INFO, "gnttab_transfer: "
|
|
+ "Transferee (d%d) has no headroom (tot %u, max %u)\n",
|
|
+ e->domain_id, e->tot_pages, e->max_pages);
|
|
+
|
|
rcu_unlock_domain(e);
|
|
put_gfn(d, gop.mfn);
|
|
page->count_info &= ~(PGC_count_mask|PGC_allocated);
|
|
@@ -1647,6 +1651,38 @@ gnttab_transfer(
|
|
/* Okay, add the page to 'e'. */
|
|
if ( unlikely(domain_adjust_tot_pages(e, 1) == 1) )
|
|
get_knownalive_domain(e);
|
|
+
|
|
+ /*
|
|
+ * We must drop the lock to avoid a possible deadlock in
|
|
+ * gnttab_prepare_for_transfer. We have reserved a page in e so can
|
|
+ * safely drop the lock and re-aquire it later to add page to the
|
|
+ * pagelist.
|
|
+ */
|
|
+ spin_unlock(&e->page_alloc_lock);
|
|
+ okay = gnttab_prepare_for_transfer(e, d, gop.ref);
|
|
+ spin_lock(&e->page_alloc_lock);
|
|
+
|
|
+ if ( unlikely(!okay) || unlikely(e->is_dying) )
|
|
+ {
|
|
+ bool_t drop_dom_ref = !domain_adjust_tot_pages(e, -1);
|
|
+
|
|
+ spin_unlock(&e->page_alloc_lock);
|
|
+
|
|
+ if ( okay /* i.e. e->is_dying due to the surrounding if() */ )
|
|
+ gdprintk(XENLOG_INFO, "gnttab_transfer: "
|
|
+ "Transferee (d%d) is now dying\n", e->domain_id);
|
|
+
|
|
+ if ( drop_dom_ref )
|
|
+ put_domain(e);
|
|
+ rcu_unlock_domain(e);
|
|
+
|
|
+ put_gfn(d, gop.mfn);
|
|
+ page->count_info &= ~(PGC_count_mask|PGC_allocated);
|
|
+ free_domheap_page(page);
|
|
+ gop.status = GNTST_general_error;
|
|
+ goto copyback;
|
|
+ }
|
|
+
|
|
page_list_add_tail(page, &e->page_list);
|
|
page_set_owner(page, e);
|
|
|