From: Julien Grall <jgrall@amazon.com>

Commit c0fe360f42 ("tools/xenstored: Extend restore code to handle
multiple input buffer") extend the read_buffered_state() to support
multiple input buffers. Unfortunately, the commit didn't go far
enough and still used sc->data (start of the buffers) for retrieving
the header. This would lead to read the wrong headers for second and
follow-up commands.

Use data in place for sc->data for the source of the memcpy()s.

Fixes: c0fe360f42 ("tools/xenstored: Extend restore code to handle multiple input buffer")
Reported-by: Raphael Ning <raphning@amazon.com>
Signed-off-by: Julien Grall <jgrall@amazon.com>

----

I unfortunately didn't spot the issue because I forgot to check whether
the REQ ID of the responses were unique.
---
 tools/xenstore/xenstored_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index cf7297a96cb1..16c856730c55 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -2717,11 +2717,11 @@ void read_state_buffered_data(const void *ctx, struct connection *conn,
 		len = sc->data_in_len - (data - sc->data);
 		if (len < sizeof(bdata->hdr)) {
 			bdata->inhdr = true;
-			memcpy(&bdata->hdr, sc->data, len);
+			memcpy(&bdata->hdr, data, len);
 			bdata->used = len;
 		} else {
 			bdata->inhdr = false;
-			memcpy(&bdata->hdr, sc->data, sizeof(bdata->hdr));
+			memcpy(&bdata->hdr, data, sizeof(bdata->hdr));
 			if (bdata->hdr.msg.len <= DEFAULT_BUFFER_SIZE)
 				bdata->buffer = bdata->default_buffer;
 			else
-- 
2.17.1

On 25.06.21 08:45, Julien Grall wrote:
> From: Julien Grall <jgrall@amazon.com>
> 
> Commit c0fe360f42 ("tools/xenstored: Extend restore code to handle
> multiple input buffer") extend the read_buffered_state() to support
> multiple input buffers. Unfortunately, the commit didn't go far
> enough and still used sc->data (start of the buffers) for retrieving
> the header. This would lead to read the wrong headers for second and
> follow-up commands.
> 
> Use data in place for sc->data for the source of the memcpy()s.
> 
> Fixes: c0fe360f42 ("tools/xenstored: Extend restore code to handle multiple input buffer")
> Reported-by: Raphael Ning <raphning@amazon.com>
> Signed-off-by: Julien Grall <jgrall@amazon.com>

Reviewed-by: Juergen Gross <jgross@suse.com>


Juergen

Hi,

On 25/06/2021 08:58, Juergen Gross wrote:
> On 25.06.21 08:45, Julien Grall wrote:
>> From: Julien Grall <jgrall@amazon.com>
>>
>> Commit c0fe360f42 ("tools/xenstored: Extend restore code to handle
>> multiple input buffer") extend the read_buffered_state() to support
>> multiple input buffers. Unfortunately, the commit didn't go far
>> enough and still used sc->data (start of the buffers) for retrieving
>> the header. This would lead to read the wrong headers for second and
>> follow-up commands.
>>
>> Use data in place for sc->data for the source of the memcpy()s.
>>
>> Fixes: c0fe360f42 ("tools/xenstored: Extend restore code to handle 
>> multiple input buffer")
>> Reported-by: Raphael Ning <raphning@amazon.com>
>> Signed-off-by: Julien Grall <jgrall@amazon.com>
> 
> Reviewed-by: Juergen Gross <jgross@suse.com>

Thank you! I have committed the patch.

Cheers,

> 
> 
> Juergen

-- 
Julien Grall