From 9246d2e070aac5cc1cdc4ab5b010c060076d74bf Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Wed, 1 Apr 2015 10:09:57 +0100 Subject: [PATCH] domctl: don't allow a toolstack domain to call domain_pause() on itself These DOMCTL subops were accidentally declared safe for disaggregation in the wake of XSA-77. This is XSA-127 / CVE-2015-2751. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Acked-by: Ian Campbell --- xen/arch/x86/domctl.c | 8 ++++++++ xen/common/domctl.c | 6 ++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index 82365a40b2..35247e1ade 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -888,6 +888,10 @@ long arch_do_domctl( { xen_guest_tsc_info_t info; + ret = -EINVAL; + if ( d == current->domain ) /* no domain_pause() */ + break; + domain_pause(d); tsc_get_info(d, &info.tsc_mode, &info.elapsed_nsec, @@ -903,6 +907,10 @@ long arch_do_domctl( case XEN_DOMCTL_settscinfo: { + ret = -EINVAL; + if ( d == current->domain ) /* no domain_pause() */ + break; + domain_pause(d); tsc_set_info(d, domctl->u.tsc_info.info.tsc_mode, domctl->u.tsc_info.info.elapsed_nsec, diff --git a/xen/common/domctl.c b/xen/common/domctl.c index c55b289d80..36412967b7 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -522,8 +522,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) case XEN_DOMCTL_resumedomain: { - domain_resume(d); - ret = 0; + if ( d == current->domain ) /* no domain_pause() */ + ret = -EINVAL; + else + domain_resume(d); } break;