[PATCH 04/11] tmem: check for a valid client ("domain") in the save subops

[PATCH 04/11] tmem: check for a valid client ("domain") in the save subops

[Jan Beulich]

[-- Attachment #1: Type: text/plain, Size: 1236 bytes --]

This is part of XSA-15 / CVE-2012-3497.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
         rc = MAX_POOLS_PER_DOMAIN;
         break;
     case TMEMC_SAVE_GET_CLIENT_WEIGHT:
+        if ( client == NULL )
+            break;
         rc = client->weight == -1 ? -2 : client->weight;
         break;
     case TMEMC_SAVE_GET_CLIENT_CAP:
+        if ( client == NULL )
+            break;
         rc = client->cap == -1 ? -2 : client->cap;
         break;
     case TMEMC_SAVE_GET_CLIENT_FLAGS:
+        if ( client == NULL )
+            break;
         rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
              (client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
         break;
@@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
         *uuid = pool->uuid[1];
         rc = 0;
     case TMEMC_SAVE_END:
+        if ( client == NULL )
+            break;
         client->live_migrating = 0;
         if ( !list_empty(&client->persistent_invalidated_list) )
             list_for_each_entry_safe(pgp,pgp2,




[-- Attachment #2: tmem-xsa-15-4 --]
[-- Type: application/octet-stream, Size: 1257 bytes --]

tmem: check for a valid client ("domain") in the save subops

This is part of XSA-15 / CVE-2012-3497.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
         rc = MAX_POOLS_PER_DOMAIN;
         break;
     case TMEMC_SAVE_GET_CLIENT_WEIGHT:
+        if ( client == NULL )
+            break;
         rc = client->weight == -1 ? -2 : client->weight;
         break;
     case TMEMC_SAVE_GET_CLIENT_CAP:
+        if ( client == NULL )
+            break;
         rc = client->cap == -1 ? -2 : client->cap;
         break;
     case TMEMC_SAVE_GET_CLIENT_FLAGS:
+        if ( client == NULL )
+            break;
         rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
              (client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
         break;
@@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
         *uuid = pool->uuid[1];
         rc = 0;
     case TMEMC_SAVE_END:
+        if ( client == NULL )
+            break;
         client->live_migrating = 0;
         if ( !list_empty(&client->persistent_invalidated_list) )
             list_for_each_entry_safe(pgp,pgp2,

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops

[Dan Magenheimer]

> From: Jan Beulich [mailto:JBeulich@suse.com]
> Sent: Wednesday, September 05, 2012 6:36 AM
> To: xen-devel
> Cc: Dan Magenheimer; Zhenzhong Duan
> Subject: [PATCH 04/11] tmem: check for a valid client ("domain") in the save subops
> 
> This is part of XSA-15 / CVE-2012-3497.
> 
> Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
> Acked-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com>
 
> --- a/xen/common/tmem.c
> +++ b/xen/common/tmem.c
> @@ -2379,12 +2379,18 @@ static NOINLINE int tmemc_save_subop(int
>          rc = MAX_POOLS_PER_DOMAIN;
>          break;
>      case TMEMC_SAVE_GET_CLIENT_WEIGHT:
> +        if ( client == NULL )
> +            break;
>          rc = client->weight == -1 ? -2 : client->weight;
>          break;
>      case TMEMC_SAVE_GET_CLIENT_CAP:
> +        if ( client == NULL )
> +            break;
>          rc = client->cap == -1 ? -2 : client->cap;
>          break;
>      case TMEMC_SAVE_GET_CLIENT_FLAGS:
> +        if ( client == NULL )
> +            break;
>          rc = (client->compress ? TMEM_CLIENT_COMPRESS : 0 ) |
>               (client->was_frozen ? TMEM_CLIENT_FROZEN : 0 );
>          break;
> @@ -2408,6 +2414,8 @@ static NOINLINE int tmemc_save_subop(int
>          *uuid = pool->uuid[1];
>          rc = 0;
>      case TMEMC_SAVE_END:
> +        if ( client == NULL )
> +            break;
>          client->live_migrating = 0;
>          if ( !list_empty(&client->persistent_invalidated_list) )
>              list_for_each_entry_safe(pgp,pgp2,
> 
> 
>