Import xsa-116 (tag 4.4.1-5)

Signed-off-by: George Dunlap <george.dunlap@eu.citrix.com>

diff --git a/SOURCES/xen-queue.am b/SOURCES/xen-queue.am
index 86cf81ac56190e772e1901fa0aba7c68654276d6..4605c1358f099e5a698e419b37009be8a33f91c1 100644 (file)
--- a/SOURCES/xen-queue.am
+++ b/SOURCES/xen-queue.am
@@ -2080,7 +2080,55 @@ index 647723d..2fac35d 100644
 1.9.1
 
 
-From 80167d17a5b9fc73e923c26cad7c9922abeb3ad5 Mon Sep 17 00:00:00 2001
+From 83f91ed9c0a5b054e6e96bf6e3816c25027f5aab Mon Sep 17 00:00:00 2001
+From: George Dunlap <george.dunlap@eu.citrix.com>
+Date: Wed, 7 Jan 2015 15:42:07 +0000
+Subject: [PATCH] x86/HVM: prevent use-after-free when destroying a domain
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+hvm_domain_relinquish_resources() can free certain domain resources
+which can still be accessed, e.g. by HVMOP_set_param, while the domain
+is being cleaned up.
+
+Signed-off-by: Mihai Donțu <mdontu@bitdefender.com>
+Tested-by: Răzvan Cojocaru <rcojocaru@bitdefender.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+---
+ xen/arch/x86/hvm/hvm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
+index 3289604..eb7e498 100644
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -625,9 +625,6 @@ int hvm_domain_initialise(struct domain *d)
+ 
+ void hvm_domain_relinquish_resources(struct domain *d)
+ {
+-    xfree(d->arch.hvm_domain.io_handler);
+-    xfree(d->arch.hvm_domain.params);
+-
+     if ( is_pvh_domain(d) )
+         return;
+ 
+@@ -650,6 +647,9 @@ void hvm_domain_relinquish_resources(struct domain *d)
+ 
+ void hvm_domain_destroy(struct domain *d)
+ {
++    xfree(d->arch.hvm_domain.io_handler);
++    xfree(d->arch.hvm_domain.params);
++
+     hvm_destroy_cacheattr_region_list(d);
+ 
+     if ( is_pvh_domain(d) )
+-- 
+1.9.1
+
+
+From 550e26ae99b7e6c5520ea3395207ca05251b37fa Mon Sep 17 00:00:00 2001
 From: Wen Congyang <wency@cn.fujitsu.com>
 Date: Thu, 11 Dec 2014 16:21:21 +0000
 Subject: [PATCH] tools: libxl: pass correct file to qemu if we use blktap2
@@ -2138,7 +2186,7 @@ index f6f7bbd..65104d5 100644
 1.9.1
 
 
-From 168069308ee140b09023bd5cfdd312e38c654133 Mon Sep 17 00:00:00 2001
+From 5a8801b5c776aea8eaa4ba59e916012716714248 Mon Sep 17 00:00:00 2001
 From: George Dunlap <george.dunlap@eu.citrix.com>
 Date: Thu, 11 Dec 2014 16:23:09 +0000
 Subject: [PATCH] it: George Dunlap <george.dunlap@eu.citrix.com>
@@ -2209,7 +2257,7 @@ index 65104d5..aef7fb8 100644
 1.9.1
 
 
-From 5fd3b05da5fbcb86d1225ffb368ab64210ee7746 Mon Sep 17 00:00:00 2001
+From 9c9845d98985ab80d7c3d55b6f3023f72312ad3e Mon Sep 17 00:00:00 2001
 From: Don Koch <dkoch@verizon.com>
 Date: Thu, 11 Dec 2014 17:02:21 +0000
 Subject: [PATCH] x86/HVM: sanity check xsave area when migrating or restoring
@@ -2235,7 +2283,7 @@ master date: 2014-10-27 16:45:09 +0100
  1 file changed, 20 insertions(+), 11 deletions(-)
 
 diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
-index 3289604..1351891 100644
+index eb7e498..18c1c26 100644
 --- a/xen/arch/x86/hvm/hvm.c
 +++ b/xen/arch/x86/hvm/hvm.c
 @@ -1041,6 +1041,7 @@ static int hvm_load_cpu_xsave_states(struct domain *d, hvm_domain_context_t *h)
@@ -2304,7 +2352,7 @@ index 3289604..1351891 100644
 1.9.1
 
 
-From 4a0d9186fa98831f48d7842bce8aeebce0bc7111 Mon Sep 17 00:00:00 2001
+From 8e31bbfd10d2c9f067a4e14ce59bf17ad879a450 Mon Sep 17 00:00:00 2001
 From: Juergen Gross <jgross@suse.com>
 Date: Thu, 11 Dec 2014 17:02:33 +0000
 Subject: [PATCH] adjust number of domains in cpupools when destroying domain
@@ -2435,7 +2483,7 @@ index 4418883..996a08a 100644
 1.9.1
 
 
-From 2bbc90604371ee5eb89f89ea3fbd881dc13c245b Mon Sep 17 00:00:00 2001
+From 375965a163fc2a24c4a45fa3c2747a59a6660eb8 Mon Sep 17 00:00:00 2001
 From: George Dunlap <george.dunlap@eu.citrix.com>
 Date: Mon, 15 Dec 2014 15:56:14 +0000
 Subject: [PATCH] Revert "libxl: prefer qdisk over blktap when choosing disk
@@ -2472,7 +2520,7 @@ index 29ed547..0f9fe2d 100644
 1.9.1
 
 
-From 336b22545fb376f4315b188525ade797515ddabd Mon Sep 17 00:00:00 2001
+From 51ecd6dd0a6dad5a92c0b771b808305ca4da6e8c Mon Sep 17 00:00:00 2001
 From: George Dunlap <george.dunlap@eu.citrix.com>
 Date: Wed, 15 Oct 2014 15:36:23 +0100
 Subject: [PATCH] xen-centos-disable-CFLAGS-for-qemu.patch
@@ -2497,7 +2545,7 @@ index 6610a8d..86d8a58 100644
 1.9.1
 
 
-From c5ef1a8c9f1194798b68d679d3a6ac77a6c3abdd Mon Sep 17 00:00:00 2001
+From 9c1ed8dcdeb5b4d9f6a2bc5075217050c7480b2b Mon Sep 17 00:00:00 2001
 From: George Dunlap <george.dunlap@eu.citrix.com>
 Date: Wed, 15 Oct 2014 15:36:23 +0100
 Subject: [PATCH] Adapt libxl to use blktap 2.5 v0.9.2

diff --git a/SPECS/xen.spec b/SPECS/xen.spec
index ec67041a2bd5a786a299cde83e8af49a04ca6c82..2504382895edb88175fd5bad69b9a3f587724220 100644 (file)
--- a/SPECS/xen.spec
+++ b/SPECS/xen.spec
@@ -19,7 +19,7 @@
 Summary: Xen is a virtual machine monitor
 Name:    xen
 Version: 4.4.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 Group:   Development/Libraries
 License: GPLv2+ and LGPLv2+ and BSD
 URL:     http://xen.org/
@@ -739,6 +739,9 @@ rm -rf %{buildroot}
 %endif
 
 %changelog
+* Wed Jan  7 2015 George Dunlap <george.dunlap@eu.citrix.com> - 4.4.1-5.el6.centos
+ - Import xsa-116
+
 * Mon Dec 15 2014 George Dunlap <george.dunlap@eu.citrix.com> - 4.4.1-4.el6.centos
  - Disabled xend by default
  - Revert 'choose qdisk first' change