ba5dde9750
53a199d7-x86-EFI-allow-FPU-XMM-use-in-runtime-service-functions.patch - Upstream patches from Jan 538c338f-x86-amd_ucode-flip-revision-numbers-in-printk.patch 538ee637-ACPI-Prevent-acpi_table_entries-from-falling-into-a-infinite-loop.patch 5390917a-VT-d-honor-APEI-firmware-first-mode-in-XSA-59-workaround-code.patch 53909259-x86-domctl-two-functional-fixes-to-XEN_DOMCTL_-gs-etvcpuextstate.patch 5390927f-x86-fix-reboot-shutdown-with-running-HVM-guests.patch 5396d818-avoid-crash-on-HVM-domain-destroy-with-PCI-passthrough.patch 5396e805-x86-HVM-refine-SMEP-test-in-HVM_CR4_GUEST_RESERVED_BITS.patch 539ebe62-x86-EFI-improve-boot-time-diagnostics.patch 539ec004-x86-mce-don-t-spam-the-console-with-CPUx-Temperature-z.patch 53a040c6-page-alloc-scrub-pages-used-by-hypervisor-upon-freeing.patch (replaces xsa100.patch) 53a1990a-IOMMU-prevent-VT-d-device-IOTLB-operations-on-wrong-IOMMU.patch - Replace 'domUloader' with 'pygrub' when converting or importing Xen domains into libvirt with xen2libvirt. domUloader is no longer provided in xen-tools. Modified: xen2libvirt.py Thu Jun 13 15:50:19 MDT 2014 - cyliu@suse.com - fate#310956: Support Direct Kernel Boot for FV guests patches would go to upstream: qemu side: qemu-support-xen-hvm-direct-kernel-boot.patch xen side: xen-pass-kernel-initrd-to-qemu.patch - bnc#880751 - VUL-0: xen: Hypervisor heap contents leaked to guests xsa100.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=320
40 lines
1.1 KiB
Diff
40 lines
1.1 KiB
Diff
References: bnc#880751 CVE-2014-4021 XSA-100
|
|
|
|
# Commit 4bd78937ec324bcef4e29ef951e0ff9815770de1
|
|
# Date 2014-06-17 15:21:10 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
page-alloc: scrub pages used by hypervisor upon freeing
|
|
|
|
... unless they're part of a fully separate pool (and hence can't ever
|
|
be used for guest allocations).
|
|
|
|
This is CVE-2014-4021 / XSA-100.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
|
|
Acked-by: Keir Fraser <keir@xen.org>
|
|
|
|
--- a/xen/common/page_alloc.c
|
|
+++ b/xen/common/page_alloc.c
|
|
@@ -1409,7 +1409,10 @@ void free_xenheap_pages(void *v, unsigne
|
|
pg = virt_to_page(v);
|
|
|
|
for ( i = 0; i < (1u << order); i++ )
|
|
+ {
|
|
+ scrub_one_page(&pg[i]);
|
|
pg[i].count_info &= ~PGC_xen_heap;
|
|
+ }
|
|
|
|
free_heap_pages(pg, order);
|
|
}
|
|
@@ -1579,6 +1582,8 @@ void free_domheap_pages(struct page_info
|
|
else
|
|
{
|
|
/* Freeing anonymous domain-heap pages. */
|
|
+ for ( i = 0; i < (1 << order); i++ )
|
|
+ scrub_one_page(&pg[i]);
|
|
free_heap_pages(pg, order);
|
|
drop_dom_ref = 0;
|
|
}
|