From nobody Wed May 15 20:27:16 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1689865541; cv=none; d=zohomail.com; s=zohoarc; b=MoeI26TyA4TZHIB01TzHGHPPv4IZBHagFn2eHpKWfcVvFpKs3XVoDorBhu86Wd5p5IC1eIkKG/6tdpkTfYD7zZ9iF9dmStqKixALJRnmZ8MK5B3vaP6UlyjQXYPBPczydNeg83m5oHjogFo0w8wCxOPGkwyXQFu63R4PvAQKvGY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1689865541; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=NUCvlbyVM3C9s83ic5gsJCxga3aRHaTw7ZzMi+f7U5E=; b=iwIyjYcjZm+x2R/1OgmHt99Qu4L1IS5YfzKgibBaiyRUMrDqZmnaMZ6cSdRkABEhLRc3+P54z6jpirdG5kRwys9E1LgC6HP9nSX58MA40mqKpM6cOBoyPyY3vXSxiANqfi36jHUw48304Ky9ivGY+1ssifE6urdBfYyw52Gmfa0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1689865541918569.2266630656773; Thu, 20 Jul 2023 08:05:41 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.566648.885748 (Exim 4.92) (envelope-from ) id 1qMVDE-0002kB-GS; Thu, 20 Jul 2023 15:05:04 +0000 Received: by outflank-mailman (output) from mailman id 566648.885748; Thu, 20 Jul 2023 15:05:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1qMVDE-0002k4-CA; Thu, 20 Jul 2023 15:05:04 +0000 Received: by outflank-mailman (input) for mailman id 566648; Thu, 20 Jul 2023 15:05:03 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1qMVDD-0002jy-Em for xen-devel@lists.xenproject.org; Thu, 20 Jul 2023 15:05:03 +0000 Received: from smtp-out2.suse.de (smtp-out2.suse.de [2001:67c:2178:6::1d]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ccde953e-270e-11ee-b23a-6b7b168915f2; Thu, 20 Jul 2023 17:05:01 +0200 (CEST) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 4BE072069F; Thu, 20 Jul 2023 15:05:01 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 1C790138EC; Thu, 20 Jul 2023 15:05:01 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id eKp3BR1NuWQJCwAAMHmgww (envelope-from ); Thu, 20 Jul 2023 15:05:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ccde953e-270e-11ee-b23a-6b7b168915f2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1689865501; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=NUCvlbyVM3C9s83ic5gsJCxga3aRHaTw7ZzMi+f7U5E=; b=jSmsj7krLV7I6B3RnlQtlBM8idaPXxe15xPPxjaqzF98DA/iwNAl9CUuBxtadsjjTpfDpH /UvfE6kehcC2KdnIG2vBLCmOjHCKYX6FKcoPdFHBj9xu5HTuZ6mx3U7Uf8i3kl62ebBjgA wWmowCrYMJBTtncX6mqTz7lKCQgTlME= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: Juergen Gross , Wei Liu , Julien Grall , Anthony PERARD Subject: [PATCH] tools/xenstore: fix XSA-417 patch Date: Thu, 20 Jul 2023 17:04:59 +0200 Message-Id: <20230720150459.31111-1-jgross@suse.com> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @suse.com) X-ZM-MESSAGEID: 1689865543220100001 Content-Type: text/plain; charset="utf-8" The fix for XSA-417 had a bug: domain_alloc_permrefs() will not return a negative value in case of an error, but a plain errno value. Note this is not considered to be a security issue, as the only case where domain_alloc_permrefs() will return an error is a failed memory allocation. As a guest should not be able to drive Xenstore out of memory, this is NOT a problem a guest can trigger at will. Fixes: ab128218225d ("tools/xenstore: fix checking node permissions") Signed-off-by: Juergen Gross Acked-by: Julien Grall --- tools/xenstore/xenstored_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_cor= e.c index 31a862b715..a1d3047e48 100644 --- a/tools/xenstore/xenstored_core.c +++ b/tools/xenstore/xenstored_core.c @@ -1784,7 +1784,7 @@ static int do_set_perms(const void *ctx, struct conne= ction *conn, if (!xenstore_strings_to_perms(perms.p, perms.num, permstr)) return errno; =20 - if (domain_alloc_permrefs(&perms) < 0) + if (domain_alloc_permrefs(&perms)) return ENOMEM; if (perms.p[0].perms & XS_PERM_IGNORE) return ENOENT; --=20 2.35.3