]> xenbits.xensource.com Git - xen.git/commit
arm: handle races between relinquish_memory and free_domheap_pages
authorIan Campbell <ian.campbell@citrix.com>
Thu, 29 Oct 2015 12:34:17 +0000 (13:34 +0100)
committerJan Beulich <jbeulich@suse.com>
Thu, 29 Oct 2015 12:34:17 +0000 (13:34 +0100)
commit1ef01396fdff88b1c3331a09ca5c69619b90f4ea
treeed252bf24009d5cb93307499b78b71900bfaf4f2
parent1c0e59ff15764e7b0c59282365974f5b8924ce83
arm: handle races between relinquish_memory and free_domheap_pages

Primarily this means XENMEM_decrease_reservation from a toolstack
domain.

Unlike x86 we have no requirement right now to queue such pages onto
a separate list, if we hit this race then the other code has already
fully accepted responsibility for freeing this page and therefore
there is no more for relinquish_memory to do.

This is CVE-2015-7814 / XSA-147.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Reviewed-by: Julien Grall <julien.grall@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/arm/domain.c