diff options
| author | Daniel Sabogal <dsabogalcc@gmail.com> | 2017-10-24 15:17:31 -0400 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2017-11-13 12:03:29 +0000 |
| commit | a7f354c759dfcaeea209dc0c4f27c631d5d249f3 (patch) | |
| tree | 2f923080b57cc24532184cdc57c40527784a3231 | |
| parent | f887532aaf9a7d20cf7839f22373f75220e553f2 (diff) | |
| download | aports-a7f354c759dfcaeea209dc0c4f27c631d5d249f3.tar.bz2 aports-a7f354c759dfcaeea209dc0c4f27c631d5d249f3.tar.xz | |
main/xen: security fix for xsa236 (CVE-2017-15597)
| -rw-r--r-- | main/xen/APKBUILD | 6 | ||||
| -rw-r--r-- | main/xen/xsa236-4.9.patch | 66 |
2 files changed, 71 insertions, 1 deletions
diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD index c1f387dde2..0a1a42bd9f 100644 --- a/main/xen/APKBUILD +++ b/main/xen/APKBUILD @@ -3,7 +3,7 @@ # Maintainer: William Pitcock <nenolod@dereferenced.org> pkgname=xen pkgver=4.9.0 -pkgrel=6 +pkgrel=7 pkgdesc="Xen hypervisor" url="http://www.xen.org/" arch="x86_64 armhf aarch64" @@ -96,6 +96,8 @@ options="!strip" # - CVE-2017-15593 XSA-242 # - CVE-2017-15592 XSA-243 # - CVE-2017-15594 XSA-244 +# 4.9.0-r7: +# - CVE-2017-15597 XSA-236 case "$CARCH" in x86*) @@ -153,6 +155,7 @@ source="https://downloads.xenproject.org/release/$pkgname/$pkgver/$pkgname-$pkgv xsa233.patch xsa234-4.9.patch xsa235-4.9.patch + xsa236-4.9.patch xsa237-1.patch xsa237-2.patch xsa237-3.patch @@ -433,6 +436,7 @@ fb742225a4f3dbf2a574c4a6e3ef61a5da0c91aaeed77a2247023bdefcd4e0b6c08f1c9ffb42eaac a322ac6c5ac2f858a59096108032fd42974eaaeeebd8f4966119149665f32bed281e333e743136e79add2e6f3844d88b6a3e4d5a685c2808702fd3a9e6396cd4 xsa233.patch cafeef137cd82cefc3e974b42b974c6562e822c9b359efb654ac374e663d9fc123be210eec17b278f40eabb77c93d3bf0ff03e445607159ad0712808a609a906 xsa234-4.9.patch 8bab6e59577b51f0c6b8a547c9a37a257bd0460e7219512e899d25f80a74084745d2a4c54e55ad12526663d40f218cb8f833b71350220d36e3750d002ff43d29 xsa235-4.9.patch +a951c3d29a6b05b42021bd49419becff51123a245256659240a3af5701bbf51e7d3c1a79835a7cc9a5fdf7c1c6aa330a35a586cb56d69d847c256642f0fc8e55 xsa236-4.9.patch a447b4f0a5379da46b5f0eb5b77eab07c3cfe8d303af6e116e03c7d88a9fc9ea154043165631d29248c07516ab8fdfd5de4da1ccf0ab7358d90fb7f9c87bf221 xsa237-1.patch 10f2d84f783fb8bae5a39c463a32f4ac5d4d2614a7eecf109dcccd5418b8ec5e523691e79b3578d9c7b113f368a94d360acb9534808c440852a91c36369f88fd xsa237-2.patch 50607fca2e02eed322927e0288c77e7a6c541794fa2c70c78ada0c2fa762b5ad0f3b5108ecb9f01d8826f89dab492d56c502236c70234e6ba741e94a39356ea3 xsa237-3.patch diff --git a/main/xen/xsa236-4.9.patch b/main/xen/xsa236-4.9.patch new file mode 100644 index 0000000000..203025dbae --- /dev/null +++ b/main/xen/xsa236-4.9.patch @@ -0,0 +1,66 @@ +From: Jan Beulich <jbeulich@suse.com> +Subject: gnttab: fix pin count / page reference race + +Dropping page references before decrementing pin counts is a bad idea +if assumptions are being made that a non-zero pin count implies a valid +page. Fix the order of operations in gnttab_copy_release_buf(), but at +the same time also remove the assertion that was found to trigger: +map_grant_ref() also has the potential of causing a race here, and +changing the order of operations there would likely be quite a bit more +involved. + +This is XSA-236. + +Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de> +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> + +--- a/xen/common/grant_table.c ++++ b/xen/common/grant_table.c +@@ -2330,9 +2330,20 @@ __acquire_grant_for_copy( + td = page_get_owner_and_reference(*page); + /* + * act->pin being non-zero should guarantee the page to have a +- * non-zero refcount and hence a valid owner. ++ * non-zero refcount and hence a valid owner (matching the one on ++ * record), with one exception: If the owning domain is dying we ++ * had better not make implications from pin count (map_grant_ref() ++ * updates pin counts before obtaining page references, for ++ * example). + */ +- ASSERT(td); ++ if ( td != rd || rd->is_dying ) ++ { ++ if ( td ) ++ put_page(*page); ++ *page = NULL; ++ rc = GNTST_bad_domain; ++ goto unlock_out_clear; ++ } + } + + act->pin += readonly ? GNTPIN_hstr_inc : GNTPIN_hstw_inc; +@@ -2451,6 +2462,11 @@ static void gnttab_copy_release_buf(stru + unmap_domain_page(buf->virt); + buf->virt = NULL; + } ++ if ( buf->have_grant ) ++ { ++ __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only); ++ buf->have_grant = 0; ++ } + if ( buf->have_type ) + { + put_page_type(buf->page); +@@ -2461,11 +2477,6 @@ static void gnttab_copy_release_buf(stru + put_page(buf->page); + buf->page = NULL; + } +- if ( buf->have_grant ) +- { +- __release_grant_for_copy(buf->domain, buf->ptr.u.ref, buf->read_only); +- buf->have_grant = 0; +- } + } + + static int gnttab_copy_claim_buf(const struct gnttab_copy *op, |