domctl/sysctl: don't leak hypervisor stack to toolstacks

This is CVE-2015-3340 / XSA-132.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
master commit: 4ff3449f0e9d175ceb9551d3f2aecb59273f639d
master date: 2015-04-21 09:03:15 +0200

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index c9a97c9ea1a7a35f120ebb57aeb9f6168a6c87d2..b8088bcb12970fbd808aed09ef701e115d656e40 100644 (file)
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -1200,7 +1200,7 @@ long arch_do_domctl(
     case XEN_DOMCTL_gettscinfo:
     {
         struct domain *d;
-        xen_guest_tsc_info_t info;
+        xen_guest_tsc_info_t info = { 0 };
 
         ret = -ESRCH;
         d = rcu_lock_domain_by_id(domctl->domain);

diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c
index 779872c6186fbef36d930dac8c2fd508ee94147a..fdf60d69fa114463b5441b53de0d42776f5e06de 100644 (file)
--- a/xen/common/sysctl.c
+++ b/xen/common/sysctl.c
@@ -95,7 +95,7 @@ long do_sysctl(XEN_GUEST_HANDLE(xen_sysctl_t) u_sysctl)
     case XEN_SYSCTL_getdomaininfolist:
     { 
         struct domain *d;
-        struct xen_domctl_getdomaininfo info;
+        struct xen_domctl_getdomaininfo info = { 0 };
         u32 num_domains = 0;
 
         rcu_read_lock(&domlist_read_lock);