* [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops
@ 2012-09-05 12:35 Jan Beulich
2012-09-05 16:39 ` Dan Magenheimer
0 siblings, 1 reply; 2+ messages in thread
From: Jan Beulich @ 2012-09-05 12:35 UTC (permalink / raw)
To: xen-devel; +Cc: dan.magenheimer, Zhenzhong Duan
[-- Attachment #1: Type: text/plain, Size: 1236 bytes --]
This is part of XSA-15 / CVE-2012-3497.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
rc = MAX_POOLS_PER_DOMAIN;
break;
case TMEMC_SAVE_GET_CLIENT_WEIGHT:
+ if ( client == NULL )
+ break;
rc = client->weight == -1 ? -2 : client->weight;
break;
case TMEMC_SAVE_GET_CLIENT_CAP:
+ if ( client == NULL )
+ break;
rc = client->cap == -1 ? -2 : client->cap;
break;
case TMEMC_SAVE_GET_CLIENT_FLAGS:
+ if ( client == NULL )
+ break;
rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
(client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
break;
@@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
*uuid = pool->uuid[1];
rc = 0;
case TMEMC_SAVE_END:
+ if ( client == NULL )
+ break;
client->live_migrating = 0;
if ( !list_empty(&client->persistent_invalidated_list) )
list_for_each_entry_safe(pgp,pgp2,
[-- Attachment #2: tmem-xsa-15-4 --]
[-- Type: application/octet-stream, Size: 1257 bytes --]
tmem: check for a valid client ("domain") in the save subops
This is part of XSA-15 / CVE-2012-3497.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
rc = MAX_POOLS_PER_DOMAIN;
break;
case TMEMC_SAVE_GET_CLIENT_WEIGHT:
+ if ( client == NULL )
+ break;
rc = client->weight == -1 ? -2 : client->weight;
break;
case TMEMC_SAVE_GET_CLIENT_CAP:
+ if ( client == NULL )
+ break;
rc = client->cap == -1 ? -2 : client->cap;
break;
case TMEMC_SAVE_GET_CLIENT_FLAGS:
+ if ( client == NULL )
+ break;
rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
(client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
break;
@@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
*uuid = pool->uuid[1];
rc = 0;
case TMEMC_SAVE_END:
+ if ( client == NULL )
+ break;
client->live_migrating = 0;
if ( !list_empty(&client->persistent_invalidated_list) )
list_for_each_entry_safe(pgp,pgp2,
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops
2012-09-05 12:35 [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops Jan Beulich
@ 2012-09-05 16:39 ` Dan Magenheimer
0 siblings, 0 replies; 2+ messages in thread
From: Dan Magenheimer @ 2012-09-05 16:39 UTC (permalink / raw)
To: Jan Beulich, xen-devel; +Cc: Zhenzhong Duan
> From: Jan Beulich [mailto:JBeulich@suse.com]
> Sent: Wednesday, September 05, 2012 6:36 AM
> To: xen-devel
> Cc: Dan Magenheimer; Zhenzhong Duan
> Subject: [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops
>
> This is part of XSA-15 / CVE-2012-3497.
>
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
> --- a/xen/common/tmem.c
> +++ b/xen/common/tmem.c
> @@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
> rc = MAX_POOLS_PER_DOMAIN;
> break;
> case TMEMC_SAVE_GET_CLIENT_WEIGHT:
> + if ( client == NULL )
> + break;
> rc = client->weight == -1 ? -2 : client->weight;
> break;
> case TMEMC_SAVE_GET_CLIENT_CAP:
> + if ( client == NULL )
> + break;
> rc = client->cap == -1 ? -2 : client->cap;
> break;
> case TMEMC_SAVE_GET_CLIENT_FLAGS:
> + if ( client == NULL )
> + break;
> rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
> (client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
> break;
> @@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
> *uuid = pool->uuid[1];
> rc = 0;
> case TMEMC_SAVE_END:
> + if ( client == NULL )
> + break;
> client->live_migrating = 0;
> if ( !list_empty(&client->persistent_invalidated_list) )
> list_for_each_entry_safe(pgp,pgp2,
>
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-09-05 16:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-05 12:35 [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops Jan Beulich
2012-09-05 16:39 ` Dan Magenheimer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).