| Message ID | 1453923738-4919-1-git-send-email-rcojocaru@bitdefender.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 27/01/2016 19:42, Razvan Cojocaru wrote: > It is currently possible to leave a monitor flag enabled even > after vm_event_cleanup_domain() has been called, potentially > leading to a crash in hvm_msr_write_intercept() and hvm_set_crX() > (when v->arch.vm_event has become NULL, but the corresponding > corresponding v->domain->arch.monitor flag is non-zero). > This patch zeroes out arch.monitor in vm_event_cleanup_domain(). > > Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> > --- > xen/arch/x86/vm_event.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/xen/arch/x86/vm_event.c b/xen/arch/x86/vm_event.c > index 9677ecc..08d678a 100644 > --- a/xen/arch/x86/vm_event.c > +++ b/xen/arch/x86/vm_event.c > @@ -56,6 +56,7 @@ void vm_event_cleanup_domain(struct domain *d) > } > > d->arch.mem_access_emulate_each_rep = 0; > + memset(&d->arch.monitor, 0, sizeof(d->arch.monitor)); > } > > void vm_event_toggle_singlestep(struct domain *d, struct vcpu *v)
On Wed, Jan 27, 2016 at 12:42 PM, Razvan Cojocaru <rcojocaru@bitdefender.com > wrote: > It is currently possible to leave a monitor flag enabled even > after vm_event_cleanup_domain() has been called, potentially > leading to a crash in hvm_msr_write_intercept() and hvm_set_crX() > (when v->arch.vm_event has become NULL, but the corresponding > corresponding v->domain->arch.monitor flag is non-zero). > This patch zeroes out arch.monitor in vm_event_cleanup_domain(). > > Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> > Acked-by: Tamas K Lengyel <tamas@tklengyel.com> > --- > xen/arch/x86/vm_event.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/xen/arch/x86/vm_event.c b/xen/arch/x86/vm_event.c > index 9677ecc..08d678a 100644 > --- a/xen/arch/x86/vm_event.c > +++ b/xen/arch/x86/vm_event.c > @@ -56,6 +56,7 @@ void vm_event_cleanup_domain(struct domain *d) > } > > d->arch.mem_access_emulate_each_rep = 0; > + memset(&d->arch.monitor, 0, sizeof(d->arch.monitor)); > } > > void vm_event_toggle_singlestep(struct domain *d, struct vcpu *v) > -- > 2.7.0 > >
diff --git a/xen/arch/x86/vm_event.c b/xen/arch/x86/vm_event.c index 9677ecc..08d678a 100644 --- a/xen/arch/x86/vm_event.c +++ b/xen/arch/x86/vm_event.c @@ -56,6 +56,7 @@ void vm_event_cleanup_domain(struct domain *d) } d->arch.mem_access_emulate_each_rep = 0; + memset(&d->arch.monitor, 0, sizeof(d->arch.monitor)); } void vm_event_toggle_singlestep(struct domain *d, struct vcpu *v)
It is currently possible to leave a monitor flag enabled even after vm_event_cleanup_domain() has been called, potentially leading to a crash in hvm_msr_write_intercept() and hvm_set_crX() (when v->arch.vm_event has become NULL, but the corresponding corresponding v->domain->arch.monitor flag is non-zero). This patch zeroes out arch.monitor in vm_event_cleanup_domain(). Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> --- xen/arch/x86/vm_event.c | 1 + 1 file changed, 1 insertion(+)