From mboxrd@z Thu Jan  1 00:00:00 1970
From: Andrew Cooper <andrew.cooper3@citrix.com>
Subject: Re: [PATCH v2] libxc: Protect xc_domain_resume from
 clobbering domain registers
Date: Tue, 20 May 2014 14:42:28 +0100
Message-ID: <537B5BC4.3070304@citrix.com>
References: <1400593028-26876-1-git-send-email-andryuk@aero.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1400593028-26876-1-git-send-email-andryuk@aero.org>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Jason Andryuk <andryuk@aero.org>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>, Ian Jackson <ian.jackson@eu.citrix.com>, Ian Campbell <ian.campbell@citrix.com>, xen-devel@lists.xen.org
List-Id: xen-devel@lists.xenproject.org

On 20/05/14 14:37, Jason Andryuk wrote:
> xc_domain_resume() expects the guest to be in state SHUTDOWN_suspend.
> However, nothing verifies the state before modify_returncode() modifies
> the domain's registers.  This will crash guest processes or the kernel
> itself.
>
> This can be demonstrated with `LIBXL_SAVE_HELPER=/bin/false xl migrate`.
>
> Signed-off-by: Jason Andryuk <andryuk@aero.org>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

> ---
> v2:
>  - Verify domid
>  - Improve error message
> ---
>  tools/libxc/xc_resume.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/tools/libxc/xc_resume.c b/tools/libxc/xc_resume.c
> index 18b4818..e423814 100644
> --- a/tools/libxc/xc_resume.c
> +++ b/tools/libxc/xc_resume.c
> @@ -33,12 +33,21 @@ static int modify_returncode(xc_interface *xch, uint32_t domid)
>      struct domain_info_context *dinfo = &_dinfo;
>      int rc;
>  
> -    if ( xc_domain_getinfo(xch, domid, 1, &info) != 1 )
> +    if ( xc_domain_getinfo(xch, domid, 1, &info) != 1 ||
> +         info.domid != domid )
>      {
>          PERROR("Could not get domain info");
>          return -1;
>      }
>  
> +    if ( !info.shutdown || (info.shutdown_reason != SHUTDOWN_suspend) )
> +    {
> +        ERROR("Dom %d not suspended: (shutdown %d, reason %d)", domid,
> +              info.shutdown, info.shutdown_reason);
> +        errno = EINVAL;
> +        return -1;
> +    }
> +
>      if ( info.hvm )
>      {
>          /* HVM guests without PV drivers have no return code to modify. */