File xsa116.patch of Package xen.openSUSE_13.2_Update

x86/HVM: prevent use-after-free when destroying a domain

hvm_domain_relinquish_resources() can free certain domain resources
which can still be accessed, e.g. by HVMOP_set_param, while the domain
is being cleaned up.

Reviewed-by: Jan Beulich <jbeulich@suse.com>

Index: xen-4.4.1-testing/xen/arch/x86/hvm/hvm.c
===================================================================
--- xen-4.4.1-testing.orig/xen/arch/x86/hvm/hvm.c
+++ xen-4.4.1-testing/xen/arch/x86/hvm/hvm.c
@@ -625,9 +625,6 @@ int hvm_domain_initialise(struct domain
 
 void hvm_domain_relinquish_resources(struct domain *d)
 {
-    xfree(d->arch.hvm_domain.io_handler);
-    xfree(d->arch.hvm_domain.params);
-
     if ( is_pvh_domain(d) )
         return;
 
@@ -650,6 +647,9 @@ void hvm_domain_relinquish_resources(str
 
 void hvm_domain_destroy(struct domain *d)
 {
+    xfree(d->arch.hvm_domain.io_handler);
+    xfree(d->arch.hvm_domain.params);
+
     hvm_destroy_cacheattr_region_list(d);
 
     if ( is_pvh_domain(d) )