From d3c151fd3a4365fc6107198bfc975807d40d157d Mon Sep 17 00:00:00 2001 From: =?utf8?q?Mihai=20Don=C8=9Bu?= Date: Tue, 6 Jan 2015 12:49:52 +0000 Subject: [PATCH] x86/HVM: prevent use-after-free when destroying a domain MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit hvm_domain_relinquish_resources() can free certain domain resources which can still be accessed, e.g. by HVMOP_set_param, while the domain is being cleaned up. This is CVE-2015-0361 / XSA-116. Signed-off-by: Mihai Donțu Tested-by: Răzvan Cojocaru Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/hvm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index bc414ff228..72be5b9f68 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1487,9 +1487,6 @@ int hvm_domain_initialise(struct domain *d) void hvm_domain_relinquish_resources(struct domain *d) { - xfree(d->arch.hvm_domain.io_handler); - xfree(d->arch.hvm_domain.params); - if ( is_pvh_domain(d) ) return; @@ -1511,6 +1508,9 @@ void hvm_domain_relinquish_resources(struct domain *d) void hvm_domain_destroy(struct domain *d) { + xfree(d->arch.hvm_domain.io_handler); + xfree(d->arch.hvm_domain.params); + hvm_destroy_cacheattr_region_list(d); if ( is_pvh_domain(d) ) -- 2.39.5