x86/shadow: fix race condition sampling the dirty vram state

d->arch.hvm_domain.dirty_vram must be read with the domain's paging lock held.

If not, two concurrent hypercalls could both end up attempting to free
dirty_vram (the second of which will free a wild pointer), or both end up
allocating a new dirty_vram structure (the first of which will be leaked).

This is XSA-104.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Tim Deegan <tim@xen.org>

Index: xen-4.1.4/xen/arch/x86/mm/shadow/common.c
===================================================================
--- xen-4.1.4.orig/xen/arch/x86/mm/shadow/common.c	2013-01-22 18:41:53.000000000 +0200
+++ xen-4.1.4/xen/arch/x86/mm/shadow/common.c	2014-09-29 16:39:00.000000000 +0300
@@ -3637,7 +3637,7 @@
     int flush_tlb = 0;
     unsigned long i;
     p2m_type_t t;
-    struct sh_dirty_vram *dirty_vram = d->arch.hvm_domain.dirty_vram;
+    struct sh_dirty_vram *dirty_vram;
     struct p2m_domain *p2m = p2m_get_hostp2m(d);
 
     if (end_pfn < begin_pfn
@@ -3647,6 +3647,8 @@
 
     shadow_lock(d);
 
+    dirty_vram = d->arch.hvm_domain.dirty_vram;
+
     if ( dirty_vram && (!nr ||
              ( begin_pfn != dirty_vram->begin_pfn
             || end_pfn   != dirty_vram->end_pfn )) )
Index: xen-4.1.4/xen/include/asm-x86/hvm/domain.h
===================================================================
--- xen-4.1.4.orig/xen/include/asm-x86/hvm/domain.h	2013-01-22 18:41:54.000000000 +0200
+++ xen-4.1.4/xen/include/asm-x86/hvm/domain.h	2014-09-29 16:39:00.000000000 +0300
@@ -69,7 +69,7 @@
     /* Memory ranges with pinned cache attributes. */
     struct list_head       pinned_cacheattr_ranges;
 
-    /* VRAM dirty support. */
+    /* VRAM dirty support.  Protect with the domain paging lock. */
     struct sh_dirty_vram *dirty_vram;
 
     /* If one of vcpus of this domain is in no_fill_mode or
