tools/xenstore: fix use after free bug in xenstore_control

[PATCH] tools/xenstore: fix use after free bug in xenstore_control

Juergen Gross posted 1 patch 3 years, 2 months ago

Download mbox

Test env passed

Test gitlab-ci failed

Patches applied successfully (tree, apply log)
git fetch https://gitlab.com/xen-project/patchew/xen tags/patchew/20210125072331.22093-1-jgross@suse.com

tools/xenstore/xenstore_control.c | 5 +++++
1 file changed, 5 insertions(+)

Expand all Fold all

[PATCH] tools/xenstore: fix use after free bug in xenstore_control

Posted by Juergen Gross 3 years, 2 months ago

There is a very unlikely use after free bug and a memory leak in
live_update_start() of xenstore_control. Fix those.

Coverity-Id: 1472399
Fixes: 7f97193e6aa858 ("tools/xenstore: add live update command to xenstore-control")
Signed-off-by: Juergen Gross <jgross@suse.com>
---
 tools/xenstore/xenstore_control.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/xenstore/xenstore_control.c b/tools/xenstore/xenstore_control.c
index 0c95cf767c..f6f4626c06 100644
--- a/tools/xenstore/xenstore_control.c
+++ b/tools/xenstore/xenstore_control.c
@@ -43,7 +43,12 @@ static int live_update_start(struct xs_handle *xsh, bool force, unsigned int to)
     if (len < 0)
         return 1;
 
+    ret = strdup("BUSY");
+    if (!ret)
+        return 1;
+
     for (time_start = time(NULL); time(NULL) - time_start < to;) {
+        free(ret);
         ret = xs_control_command(xsh, "live-update", buf, len);
         if (!ret)
             goto err;
-- 
2.26.2

Re: [PATCH] tools/xenstore: fix use after free bug in xenstore_control

Posted by Andrew Cooper 3 years, 2 months ago

On 25/01/2021 07:23, Juergen Gross wrote:
> There is a very unlikely use after free bug and a memory leak in
> live_update_start() of xenstore_control. Fix those.
>
> Coverity-Id: 1472399
> Fixes: 7f97193e6aa858 ("tools/xenstore: add live update command to xenstore-control")
> Signed-off-by: Juergen Gross <jgross@suse.com>

Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>