From nobody Mon Aug 24 18:59:52 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1776931774; cv=none; d=zohomail.com; s=zohoarc; b=eFPkFE1NM3mRmP6VhJDFoO2Bab9YkjF8o9PcCHDHkvkYAh1aGHn1t8xs4dh7mX5x81ZNV6MibAv+3lbrtTjzeBM+xFIBRVphxU1SNgemOZXxPH6duBw/uRyCoi2GsaieLmupSHrU1nJoIgL/A4k6fFnZ6IURsf8W+1bsOVH4M0U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776931774; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UsqG9+X/SlnL7BdCX9NqfxTSD27zTpZHRZjBmI+WZ58=; b=N96AmajVPEEDBejibKMq0yyb0JTQxP+oCOnwRR41mxt4MR1/YRVa2HIwPiD8OMqUqrs5/wZDE/zQxaFaW3T/ZiGmwH7uL9c2t854D/G9kbr5t7BAosEex+wEY4NUiw28s79qN7JS6mtQl5l8VcBqPTJWCLw+HUcKMqSPtJIBgIw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1776931774648503.8504385281317; Thu, 23 Apr 2026 01:09:34 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1291715.1570573 (Exim 4.92) (envelope-from ) id 1wFp7T-0006OJ-Sd; Thu, 23 Apr 2026 08:09:07 +0000 Received: by outflank-mailman (output) from mailman id 1291715.1570573; Thu, 23 Apr 2026 08:09:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wFp7T-0006O3-OA; Thu, 23 Apr 2026 08:09:07 +0000 Received: by outflank-mailman (input) for mailman id 1291715; Thu, 23 Apr 2026 08:09:07 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wFp7T-0006NT-8D for xen-devel@lists.xenproject.org; Thu, 23 Apr 2026 08:09:07 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wFp7S-000vQl-KM for xen-devel@lists.xenproject.org; Thu, 23 Apr 2026 10:09:06 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 69e9d39c-e002-0a2a0a5209dd-0a2a450688f4-28 for ; Thu, 23 Apr 2026 10:09:06 +0200 Received: from [195.135.223.131] (helo=smtp-out2.suse.de) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 69e9d3a2-7371-0a2a45060019-c387df83b19c-3 for ; Thu, 23 Apr 2026 10:09:06 +0200 Received: from imap1.dmz-prg2.suse.org (unknown [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 0B3A95BCFD; Thu, 23 Apr 2026 08:09:06 +0000 (UTC) Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id DC22C593B0; Thu, 23 Apr 2026 08:09:05 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id BK6qNKHT6WkJXgAAD6G6ig (envelope-from ); Thu, 23 Apr 2026 08:09:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References"; dkim=pass header.s=susede1 header.d=suse.com header.i="@suse.com" header.h="From:Date:Message-ID:To:Cc:MIME-Version:Content-Transfer-Encoding:In-Reply-To:References" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1776931746; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UsqG9+X/SlnL7BdCX9NqfxTSD27zTpZHRZjBmI+WZ58=; b=sOcM2DmO3hCcSkkSOQqMDHZYE7hbZLXGjCFTeAxkZHtd2fSEBs7jJH1udglCJDU4Xc1oEf bRFKKGOf8H7wUjbiLqbNGg2lyNFRyMFDwZTfpc7g+EEmdsP+y0Hf2gbpJy8OYnFhhxOT+Z VLReKxDQvom9d3+23Tx3fShk69h33+o= Authentication-Results: smtp-out2.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1776931746; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UsqG9+X/SlnL7BdCX9NqfxTSD27zTpZHRZjBmI+WZ58=; b=sOcM2DmO3hCcSkkSOQqMDHZYE7hbZLXGjCFTeAxkZHtd2fSEBs7jJH1udglCJDU4Xc1oEf bRFKKGOf8H7wUjbiLqbNGg2lyNFRyMFDwZTfpc7g+EEmdsP+y0Hf2gbpJy8OYnFhhxOT+Z VLReKxDQvom9d3+23Tx3fShk69h33+o= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: dmukhin@ford.com, Juergen Gross , Julien Grall , Anthony PERARD Subject: [PATCH 4/4] tools/xenstored: remove permissions related to dead domain Date: Thu, 23 Apr 2026 10:08:40 +0200 Message-ID: <20260423080840.530547-5-jgross@suse.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260423080840.530547-1-jgross@suse.com> References: <20260423080840.530547-1-jgross@suse.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Spamd-Result: default: False [-2.80 / 50.00]; BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; TO_DN_SOME(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.com:mid,suse.com:email,imap1.dmz-prg2.suse.org:helo]; RCVD_VIA_SMTP_AUTH(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; FUZZY_RATELIMITED(0.00)[rspamd.com]; DKIM_SIGNED(0.00)[suse.com:s=susede1]; RCPT_COUNT_FIVE(0.00)[5]; RCVD_TLS_ALL(0.00)[] X-Spam-Flag: NO X-Spam-Score: -2.80 X-Spam-Level: X-purgate-ID: tlsNG-16d1c6/1776931746-50767D75-5A35755B/0/0 X-purgate-type: clean X-purgate-size: 3648 X-ZohoMail-DKIM: pass (identity @suse.com) X-ZM-MESSAGEID: 1776931775529154100 Content-Type: text/plain; charset="utf-8" Wit unprivileged domains now capable to use the @releaseDomain watch, there is no reason not to remove any node permissions which relate to a domain which has been removed. This resolves a complex scenario where a new domain could inherit the permissions of an old one with the same domid. Signed-off-by: Juergen Gross Reviewed-by: Jason Andryuk --- tools/xenstored/domain.c | 61 ++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/tools/xenstored/domain.c b/tools/xenstored/domain.c index 0bd2a1891a..6fbb5c061a 100644 --- a/tools/xenstored/domain.c +++ b/tools/xenstored/domain.c @@ -569,24 +569,10 @@ static int domain_tree_remove_sub(const void *ctx, st= ruct connection *conn, struct node *node, void *arg) { struct domain *domain =3D arg; - int ret =3D WALK_TREE_OK; - - if (node->perms[0].id !=3D domain->domid) - return WALK_TREE_OK; + bool node_changed =3D false; + unsigned int i; =20 - if (keep_orphans) { - domain_nbentry_dec(NULL, domain->domid); - node->perms[0].id =3D priv_domid; - node->acc.memory =3D 0; - domain_nbentry_inc(NULL, priv_domid); - if (write_node_raw(NULL, node->name, node, NODE_MODIFY, true)) { - /* That's unfortunate. We only can try to continue. */ - syslog(LOG_ERR, - "error when moving orphaned node %s to dom0\n", - node->name); - } else - trace("orphaned node %s moved to dom0\n", node->name); - } else { + if (node->perms[0].id =3D=3D domain->domid && !keep_orphans) { if (rm_node(NULL, ctx, node->name)) { /* That's unfortunate. We only can try to continue. */ syslog(LOG_ERR, @@ -596,10 +582,38 @@ static int domain_tree_remove_sub(const void *ctx, st= ruct connection *conn, trace("orphaned node %s deleted\n", node->name); =20 /* Skip children in all cases in order to avoid more errors. */ - ret =3D WALK_TREE_SKIP_CHILDREN; + return WALK_TREE_SKIP_CHILDREN; } =20 - return domain->acc_val[ACC_NODES] ? ret : WALK_TREE_SUCCESS_STOP; + if (node->perms[0].id =3D=3D domain->domid) { + domain_nbentry_dec(NULL, domain->domid); + node->perms[0].id =3D priv_domid; + node->acc.memory =3D 0; + domain_nbentry_inc(NULL, priv_domid); + trace("moving orphaned node %s to dom0\n", node->name); + node_changed =3D true; + } + + for (i =3D 1; i < node->hdr.num_perms; i++) { + if (node->perms[i].id !=3D domain->domid) + continue; + memmove(node->perms + i, node->perms + i + 1, + sizeof(*node->perms) * (node->hdr.num_perms - i - 1)); + node->hdr.num_perms--; + i--; + node_changed =3D true; + } + + if (node_changed) { + if (write_node_raw(NULL, node->name, node, NODE_MODIFY, true)) { + /* That's unfortunate. We only can try to continue. */ + syslog(LOG_ERR, + "error when writing modified node %s\n", + node->name); + } + } + + return WALK_TREE_OK; } =20 static void domain_tree_remove(struct domain *domain) @@ -607,12 +621,9 @@ static void domain_tree_remove(struct domain *domain) int ret; struct walk_funcs walkfuncs =3D { .enter =3D domain_tree_remove_sub }; =20 - if (domain->acc_val[ACC_NODES]) { - ret =3D walk_node_tree(domain, NULL, "/", &walkfuncs, domain); - if (ret =3D=3D WALK_TREE_ERROR_STOP) - syslog(LOG_ERR, - "error when looking for orphaned nodes\n"); - } + ret =3D walk_node_tree(domain, NULL, "/", &walkfuncs, domain); + if (ret =3D=3D WALK_TREE_ERROR_STOP) + syslog(LOG_ERR, "error when looking for orphaned nodes\n"); =20 walk_node_tree(domain, NULL, "@releaseDomain", &walkfuncs, domain); walk_node_tree(domain, NULL, "@introduceDomain", &walkfuncs, domain); --=20 2.53.0