File 5666f7ad-libxl-Fix-bootloader-related-virtual-m... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 5666f7ad-libxl-Fix-bootloader-related-virtual-memory-leak-on-pv-build-failure.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Currently displaying revision dbf2eede0f22d32a0cc48154739aa8fe , Show latest

References: bsc#956409 CVE-2015-8341 XSA-160

# Commit 40412e3c99722229f1ec93cd95fc8486d778f5df
# Date 2015-12-08 15:30:53 +0000
# Author Ian Jackson <ian.jackson@eu.citrix.com>
# Committer Ian Jackson <Ian.Jackson@eu.citrix.com>
libxl: Fix bootloader-related virtual memory leak on pv build failure

The bootloader may call libxl__file_reference_map(), which mmap's the
pv_kernel and pv_ramdisk into process memory.  This was only unmapped,
however, on the success path of libxl__build_pv().  If there were a
failure anywhere between libxl_bootloader.c:parse_bootloader_result()
and the end of libxl__build_pv(), the calls to
libxl__file_reference_unmap() would be skipped, leaking the mapped
virtual memory.

Ideally this would be fixed by adding the unmap calls to the
destruction path for libxl__domain_build_state.  Unfortunately the
lifetime of the libxl__domain_build_state is opaque, and it doesn't
have a proper destruction path.  But, the only thing in it that isn't
from the gc are these bootloader references, and they are only ever
set for one libxl__domain_build_state, the one which is
libxl__domain_create_state.build_state.

So we can clean up in the exit path from libxl__domain_create_*, which
always comes through domcreate_complete.

Remove the now-redundant unmaps in libxl__build_pv's success path.

This is XSA-160.

Signed-off-by: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Tested-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

--- a/tools/libxl/libxl_create.c
+++ b/tools/libxl/libxl_create.c
@@ -1448,6 +1448,9 @@ static void domcreate_complete(libxl__eg
     libxl_domain_config *const d_config = dcs->guest_config;
     libxl_domain_config *d_config_saved = &dcs->guest_config_saved;
 
+    libxl__file_reference_unmap(&dcs->build_state.pv_kernel);
+    libxl__file_reference_unmap(&dcs->build_state.pv_ramdisk);
+
     if (!rc && d_config->b_info.exec_ssidref)
         rc = xc_flask_relabel_domain(CTX->xch, dcs->guest_domid, d_config->b_info.exec_ssidref);
 
--- a/tools/libxl/libxl_dom.c
+++ b/tools/libxl/libxl_dom.c
@@ -627,9 +627,6 @@ int libxl__build_pv(libxl__gc *gc, uint3
         state->store_mfn = xc_dom_p2m_host(dom, dom->xenstore_pfn);
     }
 
-    libxl__file_reference_unmap(&state->pv_kernel);
-    libxl__file_reference_unmap(&state->pv_ramdisk);
-
     ret = 0;
 out:
     xc_dom_release(dom);

Places

File 5666f7ad-libxl-Fix-bootloader-related-virtual-memory-leak-on-pv-build-failure.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Places