blob: 816a9bd84edbc7fa8914be759e9e51e86f9943ec (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
x86/HVM: prevent use-after-free when destroying a domain
hvm_domain_relinquish_resources() can free certain domain resources
which can still be accessed, e.g. by HVMOP_set_param, while the domain
is being cleaned up.
Signed-off-by: Mihai Donțu <mdontu@bitdefender.com>
Tested-by: Răzvan Cojocaru <rcojocaru@bitdefender.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1487,9 +1487,6 @@ int hvm_domain_initialise(struct domain
void hvm_domain_relinquish_resources(struct domain *d)
{
- xfree(d->arch.hvm_domain.io_handler);
- xfree(d->arch.hvm_domain.params);
-
if ( is_pvh_domain(d) )
return;
@@ -1511,6 +1508,9 @@ void hvm_domain_relinquish_resources(str
void hvm_domain_destroy(struct domain *d)
{
+ xfree(d->arch.hvm_domain.io_handler);
+ xfree(d->arch.hvm_domain.params);
+
hvm_destroy_cacheattr_region_list(d);
if ( is_pvh_domain(d) )
|
