From 46ed0083a76efa82713ea979b312fa69250380b2 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Wed, 1 Apr 2015 10:11:30 +0100 Subject: [PATCH] domctl: don't allow a toolstack domain to call domain_pause() on itself These DOMCTL subops were accidentally declared safe for disaggregation in the wake of XSA-77. This is XSA-127 / CVE-2015-2751. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Acked-by: Ian Campbell --- xen/arch/x86/domctl.c | 8 ++++++++ xen/common/domctl.c | 6 ++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 306297aa1f..07000de4b1 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -946,6 +946,10 @@ long arch_do_domctl( { xen_guest_tsc_info_t info; + ret = -EINVAL; + if ( d == current->domain ) /* no domain_pause() */ + break; + domain_pause(d); tsc_get_info(d, &info.tsc_mode, &info.elapsed_nsec, @@ -961,6 +965,10 @@ long arch_do_domctl( case XEN_DOMCTL_settscinfo: { + ret = -EINVAL; + if ( d == current->domain ) /* no domain_pause() */ + break; + domain_pause(d); tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode, domctl->u.tsc_info.info.elapsed_nsec, diff --git a/xen/common/domctl.c b/xen/common/domctl.c index bc8e9d8d7c..53c9d9195a 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -391,8 +391,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) case XEN_DOMCTL_resumedomain: { - domain_resume(d); - ret = 0; + if ( d == current->domain ) /* no domain_pause() */ + ret = -EINVAL; + else + domain_resume(d); } break; -- 2.39.5