From d03e21fdc77366a77ee06eec7905d006a9738fb8 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 17 Jun 2014 16:05:04 +0200 Subject: [PATCH] page-alloc: scrub pages used by hypervisor upon freeing ... unless they're part of a fully separate pool (and hence can't ever be used for guest allocations). This is CVE-2014-4021 / XSA-100. Signed-off-by: Jan Beulich Reviewed-by: Ian Campbell Acked-by: Keir Fraser master commit: 4bd78937ec324bcef4e29ef951e0ff9815770de1 master date: 2014-06-17 15:21:10 +0200 --- xen/common/page_alloc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 60cb01dc37..300669ee47 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1404,7 +1404,10 @@ void free_xenheap_pages(void *v, unsigned int order) pg = virt_to_page(v); for ( i = 0; i < (1u << order); i++ ) + { + scrub_one_page(&pg[i]); pg[i].count_info &= ~PGC_xen_heap; + } free_heap_pages(pg, order); } @@ -1571,6 +1574,8 @@ void free_domheap_pages(struct page_info *pg, unsigned int order) else { /* Freeing anonymous domain-heap pages. */ + for ( i = 0; i < (1 << order); i++ ) + scrub_one_page(&pg[i]); free_heap_pages(pg, order); drop_dom_ref = 0; }