-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2022-42319 / XSA-416
version 2
Xenstore: Guests can cause Xenstore to not free temporary memory
UPDATES IN VERSION 2
====================
Public release.
ISSUE DESCRIPTION
=================
When working on a request of a guest, xenstored might need to allocate
quite large amounts of memory temporarily. This memory is freed only
after the request has been finished completely.
A request is regarded to be finished only after the guest has read the
response message of the request from the ring page. Thus a guest not
reading the response can cause xenstored to not free the temporary
memory.
This can result in memory shortages causing Denial of Service (DoS) of
xenstored.
IMPACT
======
A malicious guest can cause DoS of xenstored, resulting in the inability
to create new guests or to change the configuration of already running
guests.
VULNERABLE SYSTEMS
==================
Xen systems with version 4.9 and newer running the C variant of Xenstore
(xenstored or xenstore-stubdom) are vulnerable.
Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable.
MITIGATION
==========
Using oxenstored instead of xenstored will avoid the vulnerability.
CREDITS
=======
This issue was discovered by Julien Grall of Amazon.
RESOLUTION
==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa416.patch xen-unstable
xsa416-4.16.patch Xen 4.16.x
xsa416-4.15.patch Xen 4.15.x
xsa416-4.14.patch Xen 4.14.x
xsa416-4.13.patch Xen 4.13.x
$ sha256sum xsa416*
9f5f459b0c5b71ba25503d176c59732baf2ed174688b59e51010f22f8eecd218 xsa416.meta
6a28884392997baaea046ac8f1df86ffaec64febdabf17a8753e451ef3cab0f7 xsa416.patch
5838de576be5a71be46ab2e58287ea7d9c774f68f588c7d1f472a190b5923446 xsa416-4.13.patch
cb06c57ff0158899e61b26901e06d931838f68958d610fbeff1c76edb9c8b4e1 xsa416-4.14.patch
68b7128b0f1e1d6de345dbc47dfdd583beff840c96e625fcf6e6a82679ff3732 xsa416-4.15.patch
c4bb88546b272925d85d75d62f552d91698a10faaac1a0ce6cac3c54eeeda6a2 xsa416-4.16.patch
$
DEPLOYMENT DURING EMBARGO
=========================
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+6UMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZx0IH/0A0O9/AnlHpVEM8RUVrHqDLbVozGVbroH/OsA05
Fgj5kCqgRQs03H2uMnIboDL9RbgnjqRkU1cVf0gG2MWRzvMofxjLykUN8fUxcax0
6qCnAPF1m5kFA/LE6iyjWem6949n7B/LZb2NCJ9EFwb+W1/g6/skTj82ngvlSO+6
svxuK+BnTUshcDI6b3MSos4CPVpF4VMYB8JogUo9XANUdu7mblV4jMPn/wt712MA
tEOcxeIPvzkYpPTzV5bEQGKmRy4WpnpSKDPDL8+PVFMFdyMartx98RoZFnldTmlN
fifLfsTq3h3NxTA7V0KUXdO5tb0ZPLQiN/8fn7AwO/2HtdY=
=YXaE
-----END PGP SIGNATURE-----
{
"XSA": 416,
"SupportedVersions": [
"master",
"4.16",
"4.15",
"4.14",
"4.13"
],
"Trees": [
"xen"
],
"Recipes": {
"4.13": {
"Recipes": {
"xen": {
"StableRef": "0be63c2615b268001f7cc9b72ce25eed952737dc",
"Prereqs": [
414,
415,
326
],
"Patches": [
"xsa416-4.13.patch"
]
}
}
},
"4.14": {
"Recipes": {
"xen": {
"StableRef": "016de62747b26ead5a5c763b640fe8e205cd182b",
"Prereqs": [
414,
415,
326
],
"Patches": [
"xsa416-4.14.patch"
]
}
}
},
"4.15": {
"Recipes": {
"xen": {
"StableRef": "816580afdd1730d4f85f64477a242a439af1cdf8",
"Prereqs": [
414,
415,
326
],
"Patches": [
"xsa416-4.15.patch"
]
}
}
},
"4.16": {
"Recipes": {
"xen": {
"StableRef": "1bce7fb1f702da4f7a749c6f1457ecb20bf74fca",
"Prereqs": [
412,
414,
415,
326
],
"Patches": [
"xsa416-4.16.patch"
]
}
}
},
"master": {
"Recipes": {
"xen": {
"StableRef": "cc4747be8ba157a3b310921e9ee07fb8545aa206",
"Prereqs": [
412,
414,
415,
326
],
"Patches": [
"xsa416.patch"
]
}
}
}
}
}From c761a32d1cc9b40ac95600268ba5f00bbec88925 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 13 Sep 2022 07:35:10 +0200
Subject: tools/xenstore: don't use conn->in as context for temporary
allocations
Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.
As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").
Some sub-functions need to gain the "const" attribute for the talloc
context.
This is XSA-416 / CVE-2022-42319.
Reported-by: Julien Grall <jgrall@amazon.com>
Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 264bb39d7b0e..d1aaa00bf44a 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -155,7 +155,7 @@ bool lu_is_pending(void)
struct cmd_s {
char *cmd;
- int (*func)(void *, struct connection *, char **, int);
+ int (*func)(const void *, struct connection *, char **, int);
char *pars;
/*
* max_pars can be used to limit the size of the parameter vector,
@@ -167,7 +167,7 @@ struct cmd_s {
unsigned int max_pars;
};
-static int do_control_check(void *ctx, struct connection *conn,
+static int do_control_check(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -179,7 +179,7 @@ static int do_control_check(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_log(void *ctx, struct connection *conn,
+static int do_control_log(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -281,7 +281,7 @@ static int quota_get(const void *ctx, struct connection *conn,
return domain_get_quota(ctx, conn, atoi(vec[0]));
}
-static int do_control_quota(void *ctx, struct connection *conn,
+static int do_control_quota(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -293,7 +293,7 @@ static int do_control_quota(void *ctx, struct connection *conn,
return quota_get(ctx, conn, vec, num);
}
-static int do_control_quota_s(void *ctx, struct connection *conn,
+static int do_control_quota_s(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -306,7 +306,7 @@ static int do_control_quota_s(void *ctx, struct connection *conn,
}
#ifdef __MINIOS__
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -318,7 +318,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
return 0;
}
#else
-static int do_control_logfile(void *ctx, struct connection *conn,
+static int do_control_logfile(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -333,7 +333,7 @@ static int do_control_logfile(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
FILE *fp;
@@ -373,7 +373,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
}
#endif
-static int do_control_print(void *ctx, struct connection *conn,
+static int do_control_print(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -875,7 +875,7 @@ static const char *lu_start(const void *ctx, struct connection *conn,
return NULL;
}
-static int do_control_lu(void *ctx, struct connection *conn,
+static int do_control_lu(const void *ctx, struct connection *conn,
char **vec, int num)
{
const char *ret = NULL;
@@ -922,7 +922,7 @@ static int do_control_lu(void *ctx, struct connection *conn,
}
#endif
-static int do_control_help(void *, struct connection *, char **, int);
+static int do_control_help(const void *, struct connection *, char **, int);
static struct cmd_s cmds[] = {
{ "check", do_control_check, "" },
@@ -961,7 +961,7 @@ static struct cmd_s cmds[] = {
{ "help", do_control_help, "" },
};
-static int do_control_help(void *ctx, struct connection *conn,
+static int do_control_help(const void *ctx, struct connection *conn,
char **vec, int num)
{
int cmd;
@@ -984,7 +984,8 @@ static int do_control_help(void *ctx, struct connection *conn,
return 0;
}
-int do_control(struct connection *conn, struct buffered_data *in)
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int cmd, num, off;
char **vec = NULL;
@@ -1004,11 +1005,11 @@ int do_control(struct connection *conn, struct buffered_data *in)
num = xs_count_strings(in->buffer, in->used);
if (cmds[cmd].max_pars)
num = min(num, cmds[cmd].max_pars);
- vec = talloc_array(in, char *, num);
+ vec = talloc_array(ctx, char *, num);
if (!vec)
return ENOMEM;
if (get_strings(in, vec, num) < num)
return EIO;
- return cmds[cmd].func(in, conn, vec + 1, num - 1);
+ return cmds[cmd].func(ctx, conn, vec + 1, num - 1);
}
diff --git a/tools/xenstore/xenstored_control.h b/tools/xenstore/xenstored_control.h
index 98b6fbcea2b1..a8cb76559ba1 100644
--- a/tools/xenstore/xenstored_control.h
+++ b/tools/xenstore/xenstored_control.h
@@ -16,7 +16,8 @@
along with this program; If not, see <http://www.gnu.org/licenses/>.
*/
-int do_control(struct connection *conn, struct buffered_data *in);
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void lu_read_state(void);
struct connection *lu_get_connection(void);
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index f7f1e00c715b..66bbeaf6bfb0 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1244,11 +1244,13 @@ static struct node *get_node_canonicalized(struct connection *conn,
return get_node(conn, ctx, *canonical_name, perm);
}
-static int send_directory(struct connection *conn, struct buffered_data *in)
+static int send_directory(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1257,7 +1259,7 @@ static int send_directory(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int send_directory_part(struct connection *conn,
+static int send_directory_part(const void *ctx, struct connection *conn,
struct buffered_data *in)
{
unsigned int off, len, maxlen, genlen;
@@ -1269,7 +1271,8 @@ static int send_directory_part(struct connection *conn,
return EINVAL;
/* First arg is node name. */
- node = get_node_canonicalized(conn, in, in->buffer, NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, in->buffer, NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1296,7 +1299,7 @@ static int send_directory_part(struct connection *conn,
break;
}
- data = talloc_array(in, char, genlen + len + 1);
+ data = talloc_array(ctx, char, genlen + len + 1);
if (!data)
return ENOMEM;
@@ -1312,11 +1315,13 @@ static int send_directory_part(struct connection *conn,
return 0;
}
-static int do_read(struct connection *conn, struct buffered_data *in)
+static int do_read(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1506,7 +1511,8 @@ static struct node *create_node(struct connection *conn, const void *ctx,
}
/* path, data... */
-static int do_write(struct connection *conn, struct buffered_data *in)
+static int do_write(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int offset, datalen;
struct node *node;
@@ -1520,12 +1526,12 @@ static int do_write(struct connection *conn, struct buffered_data *in)
offset = strlen(vec[0]) + 1;
datalen = in->used - offset;
- node = get_node_canonicalized(conn, in, vec[0], &name, XS_PERM_WRITE);
+ node = get_node_canonicalized(conn, ctx, vec[0], &name, XS_PERM_WRITE);
if (!node) {
/* No permissions, invalid input? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, in->buffer + offset,
+ node = create_node(conn, ctx, name, in->buffer + offset,
datalen);
if (!node)
return errno;
@@ -1536,18 +1542,19 @@ static int do_write(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
send_ack(conn, XS_WRITE);
return 0;
}
-static int do_mkdir(struct connection *conn, struct buffered_data *in)
+static int do_mkdir(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *name;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
/* If it already exists, fine. */
@@ -1557,10 +1564,10 @@ static int do_mkdir(struct connection *conn, struct buffered_data *in)
return errno;
if (!name)
return ENOMEM;
- node = create_node(conn, in, name, NULL, 0);
+ node = create_node(conn, ctx, name, NULL, 0);
if (!node)
return errno;
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
}
send_ack(conn, XS_MKDIR);
@@ -1658,24 +1665,25 @@ static int _rm(struct connection *conn, const void *ctx, struct node *node,
}
-static int do_rm(struct connection *conn, struct buffered_data *in)
+static int do_rm(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
int ret;
char *name;
char *parentname;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
if (!node) {
/* Didn't exist already? Fine, if parent exists. */
if (errno == ENOENT) {
if (!name)
return ENOMEM;
- parentname = get_parent(in, name);
+ parentname = get_parent(ctx, name);
if (!parentname)
return errno;
- node = read_node(conn, in, parentname);
+ node = read_node(conn, ctx, parentname);
if (node) {
send_ack(conn, XS_RM);
return 0;
@@ -1690,7 +1698,7 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
if (streq(name, "/"))
return EINVAL;
- ret = _rm(conn, in, node, name);
+ ret = _rm(conn, ctx, node, name);
if (ret)
return ret;
@@ -1700,13 +1708,15 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
}
-static int do_get_perms(struct connection *conn, struct buffered_data *in)
+static int do_get_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *strings;
unsigned int len;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1719,7 +1729,8 @@ static int do_get_perms(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int do_set_perms(struct connection *conn, struct buffered_data *in)
+static int do_set_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node_perms perms, old_perms;
char *name, *permstr;
@@ -1736,7 +1747,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
permstr = in->buffer + strlen(in->buffer) + 1;
- perms.p = talloc_array(in, struct xs_permissions, perms.num);
+ perms.p = talloc_array(ctx, struct xs_permissions, perms.num);
if (!perms.p)
return ENOMEM;
if (!xs_strings_to_perms(perms.p, perms.num, permstr))
@@ -1751,7 +1762,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
}
/* We must own node to do this (tools can do this too). */
- node = get_node_canonicalized(conn, in, in->buffer, &name,
+ node = get_node_canonicalized(conn, ctx, in->buffer, &name,
XS_PERM_WRITE | XS_PERM_OWNER);
if (!node)
return errno;
@@ -1786,7 +1797,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, &old_perms);
+ fire_watches(conn, ctx, name, node, false, &old_perms);
send_ack(conn, XS_SET_PERMS);
return 0;
@@ -1794,7 +1805,8 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
static struct {
const char *str;
- int (*func)(struct connection *conn, struct buffered_data *in);
+ int (*func)(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
unsigned int flags;
#define XS_FLAG_NOTID (1U << 0) /* Ignore transaction id. */
#define XS_FLAG_PRIV (1U << 1) /* Privileged domain only. */
@@ -1847,6 +1859,7 @@ static void process_message(struct connection *conn, struct buffered_data *in)
struct transaction *trans;
enum xsd_sockmsg_type type = in->hdr.msg.type;
int ret;
+ void *ctx;
/* At least send_error() and send_reply() expects conn->in == in */
assert(conn->in == in);
@@ -1871,10 +1884,17 @@ static void process_message(struct connection *conn, struct buffered_data *in)
return;
}
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ send_error(conn, ENOMEM);
+ return;
+ }
+
assert(conn->transaction == NULL);
conn->transaction = trans;
- ret = wire_funcs[type].func(conn, in);
+ ret = wire_funcs[type].func(ctx, conn, in);
+ talloc_free(ctx);
if (ret)
send_error(conn, ret);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index 983b348ee59c..b9ff4ded8360 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -330,7 +330,7 @@ bool domain_is_unprivileged(struct connection *conn)
domid_is_unprivileged(conn->domain->domid);
}
-static char *talloc_domain_path(void *context, unsigned int domid)
+static char *talloc_domain_path(const void *context, unsigned int domid)
{
return talloc_asprintf(context, "/local/domain/%u", domid);
}
@@ -566,7 +566,8 @@ static struct domain *introduce_domain(const void *ctx,
}
/* domid, gfn, evtchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in)
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
char *vec[3];
@@ -584,7 +585,7 @@ int do_introduce(struct connection *conn, struct buffered_data *in)
if (port <= 0)
return EINVAL;
- domain = introduce_domain(in, domid, port, false);
+ domain = introduce_domain(ctx, domid, port, false);
if (!domain)
return errno;
@@ -607,7 +608,8 @@ static struct domain *find_connected_domain(unsigned int domid)
return domain;
}
-int do_set_target(struct connection *conn, struct buffered_data *in)
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *vec[2];
unsigned int domid, tdomid;
@@ -651,7 +653,8 @@ static struct domain *onearg_domain(struct connection *conn,
}
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in)
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -666,7 +669,8 @@ int do_release(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_resume(struct connection *conn, struct buffered_data *in)
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -681,7 +685,8 @@ int do_resume(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_get_domain_path(struct connection *conn, struct buffered_data *in)
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *path;
const char *domid_str = onearg(in);
@@ -689,18 +694,17 @@ int do_get_domain_path(struct connection *conn, struct buffered_data *in)
if (!domid_str)
return EINVAL;
- path = talloc_domain_path(conn, atoi(domid_str));
+ path = talloc_domain_path(ctx, atoi(domid_str));
if (!path)
return errno;
send_reply(conn, XS_GET_DOMAIN_PATH, path, strlen(path) + 1);
- talloc_free(path);
-
return 0;
}
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int result;
unsigned int domid;
@@ -721,7 +725,8 @@ int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
}
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in)
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
conn_delete_all_watches(conn);
conn_delete_all_transactions(conn);
diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
index 5b86a92e1b5b..209442190911 100644
--- a/tools/xenstore/xenstored_domain.h
+++ b/tools/xenstore/xenstored_domain.h
@@ -24,25 +24,32 @@ void handle_event(void);
void check_domains(void);
/* domid, mfn, eventchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in);
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in);
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in);
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_resume(struct connection *conn, struct buffered_data *in);
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid, target */
-int do_set_target(struct connection *conn, struct buffered_data *in);
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_get_domain_path(struct connection *conn, struct buffered_data *in);
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in);
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void domain_init(int evtfd);
void dom0_init(void);
diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 28774813de83..3e3eb47326cc 100644
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -481,7 +481,8 @@ struct transaction *transaction_lookup(struct connection *conn, uint32_t id)
return ERR_PTR(-ENOENT);
}
-int do_transaction_start(struct connection *conn, struct buffered_data *in)
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct transaction *trans, *exists;
char id_str[20];
@@ -494,8 +495,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
conn->transaction_started > quota_max_transaction)
return ENOSPC;
- /* Attach transaction to input for autofree until it's complete */
- trans = talloc_zero(in, struct transaction);
+ /* Attach transaction to ctx for autofree until it's complete */
+ trans = talloc_zero(ctx, struct transaction);
if (!trans)
return ENOMEM;
@@ -544,7 +545,8 @@ static int transaction_fix_domains(struct transaction *trans, bool update)
return 0;
}
-int do_transaction_end(struct connection *conn, struct buffered_data *in)
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
const char *arg = onearg(in);
struct transaction *trans;
@@ -562,8 +564,8 @@ int do_transaction_end(struct connection *conn, struct buffered_data *in)
if (!conn->transaction_started)
conn->ta_start_time = 0;
- /* Attach transaction to in for auto-cleanup */
- talloc_steal(in, trans);
+ /* Attach transaction to ctx for auto-cleanup */
+ talloc_steal(ctx, trans);
if (streq(arg, "T")) {
if (trans->fail)
diff --git a/tools/xenstore/xenstored_transaction.h b/tools/xenstore/xenstored_transaction.h
index e3cbd6b23095..39d7f81c5127 100644
--- a/tools/xenstore/xenstored_transaction.h
+++ b/tools/xenstore/xenstored_transaction.h
@@ -29,8 +29,10 @@ struct transaction;
extern uint64_t generation;
-int do_transaction_start(struct connection *conn, struct buffered_data *node);
-int do_transaction_end(struct connection *conn, struct buffered_data *in);
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *node);
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
struct transaction *transaction_lookup(struct connection *conn, uint32_t id);
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 85362bcce314..316c08b7f754 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -243,7 +243,7 @@ static struct watch *add_watch(struct connection *conn, char *path, char *token,
return NULL;
}
-int do_watch(struct connection *conn, struct buffered_data *in)
+int do_watch(const void *ctx, struct connection *conn, struct buffered_data *in)
{
struct watch *watch;
char *vec[2];
@@ -252,7 +252,7 @@ int do_watch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- errno = check_watch_path(conn, in, &(vec[0]), &relative);
+ errno = check_watch_path(conn, ctx, &(vec[0]), &relative);
if (errno)
return errno;
@@ -283,7 +283,8 @@ int do_watch(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_unwatch(struct connection *conn, struct buffered_data *in)
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct watch *watch;
char *node, *vec[2];
@@ -291,7 +292,7 @@ int do_unwatch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- node = canonicalize(conn, in, vec[0]);
+ node = canonicalize(conn, ctx, vec[0]);
if (!node)
return ENOMEM;
list_for_each_entry(watch, &conn->watches, list) {
diff --git a/tools/xenstore/xenstored_watch.h b/tools/xenstore/xenstored_watch.h
index 0e693f0839cd..091890edca96 100644
--- a/tools/xenstore/xenstored_watch.h
+++ b/tools/xenstore/xenstored_watch.h
@@ -21,8 +21,10 @@
#include "xenstored_core.h"
-int do_watch(struct connection *conn, struct buffered_data *in);
-int do_unwatch(struct connection *conn, struct buffered_data *in);
+int do_watch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Fire all watches: !exact means all the children are affected (ie. rm). */
void fire_watches(struct connection *conn, const void *tmp, const char *name,
From 1a58ffef993fe86fe8a7c1349881650e9b0fe8a7 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 13 Sep 2022 07:35:10 +0200
Subject: tools/xenstore: don't use conn->in as context for temporary
allocations
Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.
As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").
Some sub-functions need to gain the "const" attribute for the talloc
context.
This is XSA-416 / CVE-2022-42319.
Reported-by: Julien Grall <jgrall@amazon.com>
Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 454fe9d5ab18..3585d7c6950d 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -30,11 +30,11 @@
struct cmd_s {
char *cmd;
- int (*func)(void *, struct connection *, char **, int);
+ int (*func)(const void *, struct connection *, char **, int);
char *pars;
};
-static int do_control_check(void *ctx, struct connection *conn,
+static int do_control_check(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -46,7 +46,7 @@ static int do_control_check(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_log(void *ctx, struct connection *conn,
+static int do_control_log(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -63,7 +63,7 @@ static int do_control_log(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_logfile(void *ctx, struct connection *conn,
+static int do_control_logfile(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -162,7 +162,7 @@ static int quota_get(const void *ctx, struct connection *conn,
return domain_get_quota(ctx, conn, atoi(vec[0]));
}
-static int do_control_quota(void *ctx, struct connection *conn,
+static int do_control_quota(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -174,7 +174,7 @@ static int do_control_quota(void *ctx, struct connection *conn,
return quota_get(ctx, conn, vec, num);
}
-static int do_control_quota_s(void *ctx, struct connection *conn,
+static int do_control_quota_s(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -186,7 +186,7 @@ static int do_control_quota_s(void *ctx, struct connection *conn,
return EINVAL;
}
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
FILE *fp;
@@ -225,7 +225,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_print(void *ctx, struct connection *conn,
+static int do_control_print(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -237,7 +237,7 @@ static int do_control_print(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_help(void *, struct connection *, char **, int);
+static int do_control_help(const void *, struct connection *, char **, int);
static struct cmd_s cmds[] = {
{ "check", do_control_check, "" },
@@ -250,7 +250,7 @@ static struct cmd_s cmds[] = {
{ "help", do_control_help, "" },
};
-static int do_control_help(void *ctx, struct connection *conn,
+static int do_control_help(const void *ctx, struct connection *conn,
char **vec, int num)
{
int cmd, len = 0;
@@ -286,7 +286,8 @@ static int do_control_help(void *ctx, struct connection *conn,
return 0;
}
-int do_control(struct connection *conn, struct buffered_data *in)
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int num;
int cmd;
@@ -298,7 +299,7 @@ int do_control(struct connection *conn, struct buffered_data *in)
num = xs_count_strings(in->buffer, in->used);
if (num < 1)
return EINVAL;
- vec = talloc_array(in, char *, num);
+ vec = talloc_array(ctx, char *, num);
if (!vec)
return ENOMEM;
if (get_strings(in, vec, num) != num)
@@ -306,7 +307,7 @@ int do_control(struct connection *conn, struct buffered_data *in)
for (cmd = 0; cmd < ARRAY_SIZE(cmds); cmd++)
if (streq(vec[0], cmds[cmd].cmd))
- return cmds[cmd].func(in, conn, vec + 1, num - 1);
+ return cmds[cmd].func(ctx, conn, vec + 1, num - 1);
return EINVAL;
}
diff --git a/tools/xenstore/xenstored_control.h b/tools/xenstore/xenstored_control.h
index 207e0a6fa352..faa955968db1 100644
--- a/tools/xenstore/xenstored_control.h
+++ b/tools/xenstore/xenstored_control.h
@@ -16,4 +16,5 @@
along with this program; If not, see <http://www.gnu.org/licenses/>.
*/
-int do_control(struct connection *conn, struct buffered_data *in);
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 2c0f8fd99bbd..d6bbb532fb18 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1145,11 +1145,13 @@ static struct node *get_node_canonicalized(struct connection *conn,
return get_node(conn, ctx, *canonical_name, perm);
}
-static int send_directory(struct connection *conn, struct buffered_data *in)
+static int send_directory(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1158,7 +1160,7 @@ static int send_directory(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int send_directory_part(struct connection *conn,
+static int send_directory_part(const void *ctx, struct connection *conn,
struct buffered_data *in)
{
unsigned int off, len, maxlen, genlen;
@@ -1170,7 +1172,8 @@ static int send_directory_part(struct connection *conn,
return EINVAL;
/* First arg is node name. */
- node = get_node_canonicalized(conn, in, in->buffer, NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, in->buffer, NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1197,7 +1200,7 @@ static int send_directory_part(struct connection *conn,
break;
}
- data = talloc_array(in, char, genlen + len + 1);
+ data = talloc_array(ctx, char, genlen + len + 1);
if (!data)
return ENOMEM;
@@ -1213,11 +1216,13 @@ static int send_directory_part(struct connection *conn,
return 0;
}
-static int do_read(struct connection *conn, struct buffered_data *in)
+static int do_read(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1397,7 +1402,8 @@ static struct node *create_node(struct connection *conn, const void *ctx,
}
/* path, data... */
-static int do_write(struct connection *conn, struct buffered_data *in)
+static int do_write(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int offset, datalen;
struct node *node;
@@ -1411,12 +1417,12 @@ static int do_write(struct connection *conn, struct buffered_data *in)
offset = strlen(vec[0]) + 1;
datalen = in->used - offset;
- node = get_node_canonicalized(conn, in, vec[0], &name, XS_PERM_WRITE);
+ node = get_node_canonicalized(conn, ctx, vec[0], &name, XS_PERM_WRITE);
if (!node) {
/* No permissions, invalid input? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, in->buffer + offset,
+ node = create_node(conn, ctx, name, in->buffer + offset,
datalen);
if (!node)
return errno;
@@ -1427,18 +1433,19 @@ static int do_write(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
send_ack(conn, XS_WRITE);
return 0;
}
-static int do_mkdir(struct connection *conn, struct buffered_data *in)
+static int do_mkdir(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *name;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
/* If it already exists, fine. */
@@ -1446,10 +1453,10 @@ static int do_mkdir(struct connection *conn, struct buffered_data *in)
/* No permissions? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, NULL, 0);
+ node = create_node(conn, ctx, name, NULL, 0);
if (!node)
return errno;
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
}
send_ack(conn, XS_MKDIR);
@@ -1547,22 +1554,23 @@ static int _rm(struct connection *conn, const void *ctx, struct node *node,
}
-static int do_rm(struct connection *conn, struct buffered_data *in)
+static int do_rm(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
int ret;
char *name;
char *parentname;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
if (!node) {
/* Didn't exist already? Fine, if parent exists. */
if (errno == ENOENT) {
- parentname = get_parent(in, name);
+ parentname = get_parent(ctx, name);
if (!parentname)
return errno;
- node = read_node(conn, in, parentname);
+ node = read_node(conn, ctx, parentname);
if (node) {
send_ack(conn, XS_RM);
return 0;
@@ -1577,7 +1585,7 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
if (streq(name, "/"))
return EINVAL;
- ret = _rm(conn, in, node, name);
+ ret = _rm(conn, ctx, node, name);
if (ret)
return ret;
@@ -1587,13 +1595,15 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
}
-static int do_get_perms(struct connection *conn, struct buffered_data *in)
+static int do_get_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *strings;
unsigned int len;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1606,7 +1616,8 @@ static int do_get_perms(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int do_set_perms(struct connection *conn, struct buffered_data *in)
+static int do_set_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node_perms perms, old_perms;
char *name, *permstr;
@@ -1623,7 +1634,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
permstr = in->buffer + strlen(in->buffer) + 1;
- perms.p = talloc_array(in, struct xs_permissions, perms.num);
+ perms.p = talloc_array(ctx, struct xs_permissions, perms.num);
if (!perms.p)
return ENOMEM;
if (!xs_strings_to_perms(perms.p, perms.num, permstr))
@@ -1638,7 +1649,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
}
/* We must own node to do this (tools can do this too). */
- node = get_node_canonicalized(conn, in, in->buffer, &name,
+ node = get_node_canonicalized(conn, ctx, in->buffer, &name,
XS_PERM_WRITE | XS_PERM_OWNER);
if (!node)
return errno;
@@ -1673,7 +1684,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, &old_perms);
+ fire_watches(conn, ctx, name, node, false, &old_perms);
send_ack(conn, XS_SET_PERMS);
return 0;
@@ -1681,7 +1692,8 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
static struct {
const char *str;
- int (*func)(struct connection *conn, struct buffered_data *in);
+ int (*func)(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
unsigned int flags;
#define XS_FLAG_NOTID (1U << 0) /* Ignore transaction id. */
#define XS_FLAG_PRIV (1U << 1) /* Privileged domain only. */
@@ -1754,6 +1766,7 @@ static void process_message(struct connection *conn, struct buffered_data *in)
struct transaction *trans;
enum xsd_sockmsg_type type = in->hdr.msg.type;
int ret;
+ void *ctx;
if ((unsigned int)type >= XS_TYPE_COUNT || !wire_funcs[type].func) {
eprintf("Client unknown operation %i", type);
@@ -1774,10 +1787,17 @@ static void process_message(struct connection *conn, struct buffered_data *in)
return;
}
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ send_error(conn, ENOMEM);
+ return;
+ }
+
assert(conn->transaction == NULL);
conn->transaction = trans;
- ret = wire_funcs[type].func(conn, in);
+ ret = wire_funcs[type].func(ctx, conn, in);
+ talloc_free(ctx);
if (ret)
send_error(conn, ret);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index f458314c8e01..04bdf5179227 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -337,7 +337,7 @@ bool domain_can_write(struct connection *conn)
return ((intf->rsp_prod - intf->rsp_cons) != XENSTORE_RING_SIZE);
}
-static char *talloc_domain_path(void *context, unsigned int domid)
+static char *talloc_domain_path(const void *context, unsigned int domid)
{
return talloc_asprintf(context, "/local/domain/%u", domid);
}
@@ -479,7 +479,8 @@ static void domain_conn_reset(struct domain *domain)
}
/* domid, mfn, evtchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in)
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
char *vec[3];
@@ -563,7 +564,8 @@ static struct domain *find_connected_domain(unsigned int domid)
return domain;
}
-int do_set_target(struct connection *conn, struct buffered_data *in)
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *vec[2];
unsigned int domid, tdomid;
@@ -610,7 +612,8 @@ static struct domain *onearg_domain(struct connection *conn,
}
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in)
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -625,7 +628,8 @@ int do_release(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_resume(struct connection *conn, struct buffered_data *in)
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -640,7 +644,8 @@ int do_resume(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_get_domain_path(struct connection *conn, struct buffered_data *in)
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *path;
const char *domid_str = onearg(in);
@@ -648,18 +653,17 @@ int do_get_domain_path(struct connection *conn, struct buffered_data *in)
if (!domid_str)
return EINVAL;
- path = talloc_domain_path(conn, atoi(domid_str));
+ path = talloc_domain_path(ctx, atoi(domid_str));
if (!path)
return errno;
send_reply(conn, XS_GET_DOMAIN_PATH, path, strlen(path) + 1);
- talloc_free(path);
-
return 0;
}
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int result;
unsigned int domid;
@@ -680,7 +684,8 @@ int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
}
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in)
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
conn_delete_all_watches(conn);
conn_delete_all_transactions(conn);
diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
index e013a9991ca8..732eb8fa75e1 100644
--- a/tools/xenstore/xenstored_domain.h
+++ b/tools/xenstore/xenstored_domain.h
@@ -22,25 +22,32 @@
void handle_event(void);
/* domid, mfn, eventchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in);
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in);
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in);
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_resume(struct connection *conn, struct buffered_data *in);
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid, target */
-int do_set_target(struct connection *conn, struct buffered_data *in);
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_get_domain_path(struct connection *conn, struct buffered_data *in);
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in);
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void domain_init(void);
diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 6e29118c800d..cd592845e7ca 100644
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -487,7 +487,8 @@ struct transaction *transaction_lookup(struct connection *conn, uint32_t id)
return ERR_PTR(-ENOENT);
}
-int do_transaction_start(struct connection *conn, struct buffered_data *in)
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct transaction *trans, *exists;
char id_str[20];
@@ -500,8 +501,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
conn->transaction_started > quota_max_transaction)
return ENOSPC;
- /* Attach transaction to input for autofree until it's complete */
- trans = talloc_zero(in, struct transaction);
+ /* Attach transaction to ctx for autofree until it's complete */
+ trans = talloc_zero(ctx, struct transaction);
if (!trans)
return ENOMEM;
@@ -548,7 +549,8 @@ static int transaction_fix_domains(struct transaction *trans, bool update)
return 0;
}
-int do_transaction_end(struct connection *conn, struct buffered_data *in)
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
const char *arg = onearg(in);
struct transaction *trans;
@@ -564,8 +566,8 @@ int do_transaction_end(struct connection *conn, struct buffered_data *in)
list_del(&trans->list);
conn->transaction_started--;
- /* Attach transaction to in for auto-cleanup */
- talloc_steal(in, trans);
+ /* Attach transaction to ctx for auto-cleanup */
+ talloc_steal(ctx, trans);
if (streq(arg, "T")) {
if (trans->fail)
diff --git a/tools/xenstore/xenstored_transaction.h b/tools/xenstore/xenstored_transaction.h
index e3cbd6b23095..39d7f81c5127 100644
--- a/tools/xenstore/xenstored_transaction.h
+++ b/tools/xenstore/xenstored_transaction.h
@@ -29,8 +29,10 @@ struct transaction;
extern uint64_t generation;
-int do_transaction_start(struct connection *conn, struct buffered_data *node);
-int do_transaction_end(struct connection *conn, struct buffered_data *in);
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *node);
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
struct transaction *transaction_lookup(struct connection *conn, uint32_t id);
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 19d0fb01b1c4..13627ce97266 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -184,7 +184,7 @@ static int destroy_watch(void *_watch)
return 0;
}
-int do_watch(struct connection *conn, struct buffered_data *in)
+int do_watch(const void *ctx, struct connection *conn, struct buffered_data *in)
{
struct watch *watch;
char *vec[2];
@@ -200,7 +200,7 @@ int do_watch(struct connection *conn, struct buffered_data *in)
/* check if valid event */
} else {
relative = !strstarts(vec[0], "/");
- vec[0] = canonicalize(conn, in, vec[0]);
+ vec[0] = canonicalize(conn, ctx, vec[0]);
if (!vec[0])
return ENOMEM;
if (!is_valid_nodename(vec[0]))
@@ -250,7 +250,8 @@ int do_watch(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_unwatch(struct connection *conn, struct buffered_data *in)
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct watch *watch;
char *node, *vec[2];
@@ -258,7 +259,7 @@ int do_unwatch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- node = canonicalize(conn, in, vec[0]);
+ node = canonicalize(conn, ctx, vec[0]);
if (!node)
return ENOMEM;
list_for_each_entry(watch, &conn->watches, list) {
diff --git a/tools/xenstore/xenstored_watch.h b/tools/xenstore/xenstored_watch.h
index 03094374f379..40455dff5d2b 100644
--- a/tools/xenstore/xenstored_watch.h
+++ b/tools/xenstore/xenstored_watch.h
@@ -21,8 +21,10 @@
#include "xenstored_core.h"
-int do_watch(struct connection *conn, struct buffered_data *in);
-int do_unwatch(struct connection *conn, struct buffered_data *in);
+int do_watch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Fire all watches: !exact means all the children are affected (ie. rm). */
void fire_watches(struct connection *conn, const void *tmp, const char *name,
From 3fc1478ad45a33de058dba9255a7672f80a6cbdd Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 13 Sep 2022 07:35:10 +0200
Subject: tools/xenstore: don't use conn->in as context for temporary
allocations
Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.
As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").
Some sub-functions need to gain the "const" attribute for the talloc
context.
This is XSA-416 / CVE-2022-42319.
Reported-by: Julien Grall <jgrall@amazon.com>
Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 0227a5565657..05e38e576a3d 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -30,11 +30,11 @@
struct cmd_s {
char *cmd;
- int (*func)(void *, struct connection *, char **, int);
+ int (*func)(const void *, struct connection *, char **, int);
char *pars;
};
-static int do_control_check(void *ctx, struct connection *conn,
+static int do_control_check(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -46,7 +46,7 @@ static int do_control_check(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_log(void *ctx, struct connection *conn,
+static int do_control_log(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -147,7 +147,7 @@ static int quota_get(const void *ctx, struct connection *conn,
return domain_get_quota(ctx, conn, atoi(vec[0]));
}
-static int do_control_quota(void *ctx, struct connection *conn,
+static int do_control_quota(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -159,7 +159,7 @@ static int do_control_quota(void *ctx, struct connection *conn,
return quota_get(ctx, conn, vec, num);
}
-static int do_control_quota_s(void *ctx, struct connection *conn,
+static int do_control_quota_s(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -172,7 +172,7 @@ static int do_control_quota_s(void *ctx, struct connection *conn,
}
#ifdef __MINIOS__
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -184,7 +184,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
return 0;
}
#else
-static int do_control_logfile(void *ctx, struct connection *conn,
+static int do_control_logfile(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -199,7 +199,7 @@ static int do_control_logfile(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
FILE *fp;
@@ -239,7 +239,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
}
#endif
-static int do_control_print(void *ctx, struct connection *conn,
+static int do_control_print(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -251,7 +251,7 @@ static int do_control_print(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_help(void *, struct connection *, char **, int);
+static int do_control_help(const void *, struct connection *, char **, int);
static struct cmd_s cmds[] = {
{ "check", do_control_check, "" },
@@ -268,7 +268,7 @@ static struct cmd_s cmds[] = {
{ "help", do_control_help, "" },
};
-static int do_control_help(void *ctx, struct connection *conn,
+static int do_control_help(const void *ctx, struct connection *conn,
char **vec, int num)
{
int cmd, len = 0;
@@ -304,7 +304,8 @@ static int do_control_help(void *ctx, struct connection *conn,
return 0;
}
-int do_control(struct connection *conn, struct buffered_data *in)
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int num;
int cmd;
@@ -316,7 +317,7 @@ int do_control(struct connection *conn, struct buffered_data *in)
num = xs_count_strings(in->buffer, in->used);
if (num < 1)
return EINVAL;
- vec = talloc_array(in, char *, num);
+ vec = talloc_array(ctx, char *, num);
if (!vec)
return ENOMEM;
if (get_strings(in, vec, num) != num)
@@ -324,7 +325,7 @@ int do_control(struct connection *conn, struct buffered_data *in)
for (cmd = 0; cmd < ARRAY_SIZE(cmds); cmd++)
if (streq(vec[0], cmds[cmd].cmd))
- return cmds[cmd].func(in, conn, vec + 1, num - 1);
+ return cmds[cmd].func(ctx, conn, vec + 1, num - 1);
return EINVAL;
}
diff --git a/tools/xenstore/xenstored_control.h b/tools/xenstore/xenstored_control.h
index 207e0a6fa352..faa955968db1 100644
--- a/tools/xenstore/xenstored_control.h
+++ b/tools/xenstore/xenstored_control.h
@@ -16,4 +16,5 @@
along with this program; If not, see <http://www.gnu.org/licenses/>.
*/
-int do_control(struct connection *conn, struct buffered_data *in);
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 6ed1ae261470..28724ef10a4b 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1147,11 +1147,13 @@ static struct node *get_node_canonicalized(struct connection *conn,
return get_node(conn, ctx, *canonical_name, perm);
}
-static int send_directory(struct connection *conn, struct buffered_data *in)
+static int send_directory(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1160,7 +1162,7 @@ static int send_directory(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int send_directory_part(struct connection *conn,
+static int send_directory_part(const void *ctx, struct connection *conn,
struct buffered_data *in)
{
unsigned int off, len, maxlen, genlen;
@@ -1172,7 +1174,8 @@ static int send_directory_part(struct connection *conn,
return EINVAL;
/* First arg is node name. */
- node = get_node_canonicalized(conn, in, in->buffer, NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, in->buffer, NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1199,7 +1202,7 @@ static int send_directory_part(struct connection *conn,
break;
}
- data = talloc_array(in, char, genlen + len + 1);
+ data = talloc_array(ctx, char, genlen + len + 1);
if (!data)
return ENOMEM;
@@ -1215,11 +1218,13 @@ static int send_directory_part(struct connection *conn,
return 0;
}
-static int do_read(struct connection *conn, struct buffered_data *in)
+static int do_read(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1399,7 +1404,8 @@ static struct node *create_node(struct connection *conn, const void *ctx,
}
/* path, data... */
-static int do_write(struct connection *conn, struct buffered_data *in)
+static int do_write(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int offset, datalen;
struct node *node;
@@ -1413,12 +1419,12 @@ static int do_write(struct connection *conn, struct buffered_data *in)
offset = strlen(vec[0]) + 1;
datalen = in->used - offset;
- node = get_node_canonicalized(conn, in, vec[0], &name, XS_PERM_WRITE);
+ node = get_node_canonicalized(conn, ctx, vec[0], &name, XS_PERM_WRITE);
if (!node) {
/* No permissions, invalid input? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, in->buffer + offset,
+ node = create_node(conn, ctx, name, in->buffer + offset,
datalen);
if (!node)
return errno;
@@ -1429,18 +1435,19 @@ static int do_write(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
send_ack(conn, XS_WRITE);
return 0;
}
-static int do_mkdir(struct connection *conn, struct buffered_data *in)
+static int do_mkdir(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *name;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
/* If it already exists, fine. */
@@ -1448,10 +1455,10 @@ static int do_mkdir(struct connection *conn, struct buffered_data *in)
/* No permissions? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, NULL, 0);
+ node = create_node(conn, ctx, name, NULL, 0);
if (!node)
return errno;
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
}
send_ack(conn, XS_MKDIR);
@@ -1549,22 +1556,23 @@ static int _rm(struct connection *conn, const void *ctx, struct node *node,
}
-static int do_rm(struct connection *conn, struct buffered_data *in)
+static int do_rm(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
int ret;
char *name;
char *parentname;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
if (!node) {
/* Didn't exist already? Fine, if parent exists. */
if (errno == ENOENT) {
- parentname = get_parent(in, name);
+ parentname = get_parent(ctx, name);
if (!parentname)
return errno;
- node = read_node(conn, in, parentname);
+ node = read_node(conn, ctx, parentname);
if (node) {
send_ack(conn, XS_RM);
return 0;
@@ -1579,7 +1587,7 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
if (streq(name, "/"))
return EINVAL;
- ret = _rm(conn, in, node, name);
+ ret = _rm(conn, ctx, node, name);
if (ret)
return ret;
@@ -1589,13 +1597,15 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
}
-static int do_get_perms(struct connection *conn, struct buffered_data *in)
+static int do_get_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *strings;
unsigned int len;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1608,7 +1618,8 @@ static int do_get_perms(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int do_set_perms(struct connection *conn, struct buffered_data *in)
+static int do_set_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node_perms perms, old_perms;
char *name, *permstr;
@@ -1625,7 +1636,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
permstr = in->buffer + strlen(in->buffer) + 1;
- perms.p = talloc_array(in, struct xs_permissions, perms.num);
+ perms.p = talloc_array(ctx, struct xs_permissions, perms.num);
if (!perms.p)
return ENOMEM;
if (!xs_strings_to_perms(perms.p, perms.num, permstr))
@@ -1640,7 +1651,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
}
/* We must own node to do this (tools can do this too). */
- node = get_node_canonicalized(conn, in, in->buffer, &name,
+ node = get_node_canonicalized(conn, ctx, in->buffer, &name,
XS_PERM_WRITE | XS_PERM_OWNER);
if (!node)
return errno;
@@ -1675,7 +1686,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, &old_perms);
+ fire_watches(conn, ctx, name, node, false, &old_perms);
send_ack(conn, XS_SET_PERMS);
return 0;
@@ -1683,7 +1694,8 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
static struct {
const char *str;
- int (*func)(struct connection *conn, struct buffered_data *in);
+ int (*func)(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
unsigned int flags;
#define XS_FLAG_NOTID (1U << 0) /* Ignore transaction id. */
#define XS_FLAG_PRIV (1U << 1) /* Privileged domain only. */
@@ -1756,6 +1768,7 @@ static void process_message(struct connection *conn, struct buffered_data *in)
struct transaction *trans;
enum xsd_sockmsg_type type = in->hdr.msg.type;
int ret;
+ void *ctx;
if ((unsigned int)type >= XS_TYPE_COUNT || !wire_funcs[type].func) {
eprintf("Client unknown operation %i", type);
@@ -1776,10 +1789,17 @@ static void process_message(struct connection *conn, struct buffered_data *in)
return;
}
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ send_error(conn, ENOMEM);
+ return;
+ }
+
assert(conn->transaction == NULL);
conn->transaction = trans;
- ret = wire_funcs[type].func(conn, in);
+ ret = wire_funcs[type].func(ctx, conn, in);
+ talloc_free(ctx);
if (ret)
send_error(conn, ret);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index dd3ae15ea4fd..2bdd8e589d8a 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -333,7 +333,7 @@ bool domain_can_write(struct connection *conn)
return ((intf->rsp_prod - intf->rsp_cons) != XENSTORE_RING_SIZE);
}
-static char *talloc_domain_path(void *context, unsigned int domid)
+static char *talloc_domain_path(const void *context, unsigned int domid)
{
return talloc_asprintf(context, "/local/domain/%u", domid);
}
@@ -475,7 +475,8 @@ static void domain_conn_reset(struct domain *domain)
}
/* domid, gfn, evtchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in)
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
char *vec[3];
@@ -556,7 +557,8 @@ static struct domain *find_connected_domain(unsigned int domid)
return domain;
}
-int do_set_target(struct connection *conn, struct buffered_data *in)
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *vec[2];
unsigned int domid, tdomid;
@@ -603,7 +605,8 @@ static struct domain *onearg_domain(struct connection *conn,
}
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in)
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -618,7 +621,8 @@ int do_release(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_resume(struct connection *conn, struct buffered_data *in)
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -633,7 +637,8 @@ int do_resume(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_get_domain_path(struct connection *conn, struct buffered_data *in)
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *path;
const char *domid_str = onearg(in);
@@ -641,18 +646,17 @@ int do_get_domain_path(struct connection *conn, struct buffered_data *in)
if (!domid_str)
return EINVAL;
- path = talloc_domain_path(conn, atoi(domid_str));
+ path = talloc_domain_path(ctx, atoi(domid_str));
if (!path)
return errno;
send_reply(conn, XS_GET_DOMAIN_PATH, path, strlen(path) + 1);
- talloc_free(path);
-
return 0;
}
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int result;
unsigned int domid;
@@ -673,7 +677,8 @@ int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
}
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in)
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
conn_delete_all_watches(conn);
conn_delete_all_transactions(conn);
diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
index e013a9991ca8..732eb8fa75e1 100644
--- a/tools/xenstore/xenstored_domain.h
+++ b/tools/xenstore/xenstored_domain.h
@@ -22,25 +22,32 @@
void handle_event(void);
/* domid, mfn, eventchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in);
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in);
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in);
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_resume(struct connection *conn, struct buffered_data *in);
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid, target */
-int do_set_target(struct connection *conn, struct buffered_data *in);
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_get_domain_path(struct connection *conn, struct buffered_data *in);
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in);
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void domain_init(void);
diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 6e29118c800d..cd592845e7ca 100644
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -487,7 +487,8 @@ struct transaction *transaction_lookup(struct connection *conn, uint32_t id)
return ERR_PTR(-ENOENT);
}
-int do_transaction_start(struct connection *conn, struct buffered_data *in)
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct transaction *trans, *exists;
char id_str[20];
@@ -500,8 +501,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
conn->transaction_started > quota_max_transaction)
return ENOSPC;
- /* Attach transaction to input for autofree until it's complete */
- trans = talloc_zero(in, struct transaction);
+ /* Attach transaction to ctx for autofree until it's complete */
+ trans = talloc_zero(ctx, struct transaction);
if (!trans)
return ENOMEM;
@@ -548,7 +549,8 @@ static int transaction_fix_domains(struct transaction *trans, bool update)
return 0;
}
-int do_transaction_end(struct connection *conn, struct buffered_data *in)
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
const char *arg = onearg(in);
struct transaction *trans;
@@ -564,8 +566,8 @@ int do_transaction_end(struct connection *conn, struct buffered_data *in)
list_del(&trans->list);
conn->transaction_started--;
- /* Attach transaction to in for auto-cleanup */
- talloc_steal(in, trans);
+ /* Attach transaction to ctx for auto-cleanup */
+ talloc_steal(ctx, trans);
if (streq(arg, "T")) {
if (trans->fail)
diff --git a/tools/xenstore/xenstored_transaction.h b/tools/xenstore/xenstored_transaction.h
index e3cbd6b23095..39d7f81c5127 100644
--- a/tools/xenstore/xenstored_transaction.h
+++ b/tools/xenstore/xenstored_transaction.h
@@ -29,8 +29,10 @@ struct transaction;
extern uint64_t generation;
-int do_transaction_start(struct connection *conn, struct buffered_data *node);
-int do_transaction_end(struct connection *conn, struct buffered_data *in);
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *node);
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
struct transaction *transaction_lookup(struct connection *conn, uint32_t id);
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 19d0fb01b1c4..13627ce97266 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -184,7 +184,7 @@ static int destroy_watch(void *_watch)
return 0;
}
-int do_watch(struct connection *conn, struct buffered_data *in)
+int do_watch(const void *ctx, struct connection *conn, struct buffered_data *in)
{
struct watch *watch;
char *vec[2];
@@ -200,7 +200,7 @@ int do_watch(struct connection *conn, struct buffered_data *in)
/* check if valid event */
} else {
relative = !strstarts(vec[0], "/");
- vec[0] = canonicalize(conn, in, vec[0]);
+ vec[0] = canonicalize(conn, ctx, vec[0]);
if (!vec[0])
return ENOMEM;
if (!is_valid_nodename(vec[0]))
@@ -250,7 +250,8 @@ int do_watch(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_unwatch(struct connection *conn, struct buffered_data *in)
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct watch *watch;
char *node, *vec[2];
@@ -258,7 +259,7 @@ int do_unwatch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- node = canonicalize(conn, in, vec[0]);
+ node = canonicalize(conn, ctx, vec[0]);
if (!node)
return ENOMEM;
list_for_each_entry(watch, &conn->watches, list) {
diff --git a/tools/xenstore/xenstored_watch.h b/tools/xenstore/xenstored_watch.h
index 03094374f379..40455dff5d2b 100644
--- a/tools/xenstore/xenstored_watch.h
+++ b/tools/xenstore/xenstored_watch.h
@@ -21,8 +21,10 @@
#include "xenstored_core.h"
-int do_watch(struct connection *conn, struct buffered_data *in);
-int do_unwatch(struct connection *conn, struct buffered_data *in);
+int do_watch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Fire all watches: !exact means all the children are affected (ie. rm). */
void fire_watches(struct connection *conn, const void *tmp, const char *name,
From da85dd281119390216081bce1463f3d9b10ba1c7 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 13 Sep 2022 07:35:10 +0200
Subject: tools/xenstore: don't use conn->in as context for temporary
allocations
Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.
As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").
Some sub-functions need to gain the "const" attribute for the talloc
context.
This is XSA-416 / CVE-2022-42319.
Reported-by: Julien Grall <jgrall@amazon.com>
Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 980279fa53ff..95a60bf57858 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -107,7 +107,7 @@ static const char *lu_begin(struct connection *conn)
struct cmd_s {
char *cmd;
- int (*func)(void *, struct connection *, char **, int);
+ int (*func)(const void *, struct connection *, char **, int);
char *pars;
/*
* max_pars can be used to limit the size of the parameter vector,
@@ -119,7 +119,7 @@ struct cmd_s {
unsigned int max_pars;
};
-static int do_control_check(void *ctx, struct connection *conn,
+static int do_control_check(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -131,7 +131,7 @@ static int do_control_check(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_log(void *ctx, struct connection *conn,
+static int do_control_log(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -233,7 +233,7 @@ static int quota_get(const void *ctx, struct connection *conn,
return domain_get_quota(ctx, conn, atoi(vec[0]));
}
-static int do_control_quota(void *ctx, struct connection *conn,
+static int do_control_quota(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -245,7 +245,7 @@ static int do_control_quota(void *ctx, struct connection *conn,
return quota_get(ctx, conn, vec, num);
}
-static int do_control_quota_s(void *ctx, struct connection *conn,
+static int do_control_quota_s(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -258,7 +258,7 @@ static int do_control_quota_s(void *ctx, struct connection *conn,
}
#ifdef __MINIOS__
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -270,7 +270,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
return 0;
}
#else
-static int do_control_logfile(void *ctx, struct connection *conn,
+static int do_control_logfile(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -285,7 +285,7 @@ static int do_control_logfile(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
FILE *fp;
@@ -325,7 +325,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
}
#endif
-static int do_control_print(void *ctx, struct connection *conn,
+static int do_control_print(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -802,7 +802,7 @@ static const char *lu_start(const void *ctx, struct connection *conn,
return NULL;
}
-static int do_control_lu(void *ctx, struct connection *conn,
+static int do_control_lu(const void *ctx, struct connection *conn,
char **vec, int num)
{
const char *ret = NULL;
@@ -852,7 +852,7 @@ static int do_control_lu(void *ctx, struct connection *conn,
}
#endif
-static int do_control_help(void *, struct connection *, char **, int);
+static int do_control_help(const void *, struct connection *, char **, int);
static struct cmd_s cmds[] = {
{ "check", do_control_check, "" },
@@ -891,7 +891,7 @@ static struct cmd_s cmds[] = {
{ "help", do_control_help, "" },
};
-static int do_control_help(void *ctx, struct connection *conn,
+static int do_control_help(const void *ctx, struct connection *conn,
char **vec, int num)
{
int cmd, len = 0;
@@ -927,7 +927,8 @@ static int do_control_help(void *ctx, struct connection *conn,
return 0;
}
-int do_control(struct connection *conn, struct buffered_data *in)
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int cmd, num, off;
char **vec = NULL;
@@ -947,11 +948,11 @@ int do_control(struct connection *conn, struct buffered_data *in)
num = xs_count_strings(in->buffer, in->used);
if (cmds[cmd].max_pars)
num = min(num, cmds[cmd].max_pars);
- vec = talloc_array(in, char *, num);
+ vec = talloc_array(ctx, char *, num);
if (!vec)
return ENOMEM;
if (get_strings(in, vec, num) < num)
return EIO;
- return cmds[cmd].func(in, conn, vec + 1, num - 1);
+ return cmds[cmd].func(ctx, conn, vec + 1, num - 1);
}
diff --git a/tools/xenstore/xenstored_control.h b/tools/xenstore/xenstored_control.h
index aac61f05908f..6430c3769361 100644
--- a/tools/xenstore/xenstored_control.h
+++ b/tools/xenstore/xenstored_control.h
@@ -16,5 +16,6 @@
along with this program; If not, see <http://www.gnu.org/licenses/>.
*/
-int do_control(struct connection *conn, struct buffered_data *in);
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void lu_read_state(void);
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index f27d5c0101bc..806f24bbab8b 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1214,11 +1214,13 @@ static struct node *get_node_canonicalized(struct connection *conn,
return get_node(conn, ctx, *canonical_name, perm);
}
-static int send_directory(struct connection *conn, struct buffered_data *in)
+static int send_directory(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1227,7 +1229,7 @@ static int send_directory(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int send_directory_part(struct connection *conn,
+static int send_directory_part(const void *ctx, struct connection *conn,
struct buffered_data *in)
{
unsigned int off, len, maxlen, genlen;
@@ -1239,7 +1241,8 @@ static int send_directory_part(struct connection *conn,
return EINVAL;
/* First arg is node name. */
- node = get_node_canonicalized(conn, in, in->buffer, NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, in->buffer, NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1266,7 +1269,7 @@ static int send_directory_part(struct connection *conn,
break;
}
- data = talloc_array(in, char, genlen + len + 1);
+ data = talloc_array(ctx, char, genlen + len + 1);
if (!data)
return ENOMEM;
@@ -1282,11 +1285,13 @@ static int send_directory_part(struct connection *conn,
return 0;
}
-static int do_read(struct connection *conn, struct buffered_data *in)
+static int do_read(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1476,7 +1481,8 @@ static struct node *create_node(struct connection *conn, const void *ctx,
}
/* path, data... */
-static int do_write(struct connection *conn, struct buffered_data *in)
+static int do_write(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int offset, datalen;
struct node *node;
@@ -1490,12 +1496,12 @@ static int do_write(struct connection *conn, struct buffered_data *in)
offset = strlen(vec[0]) + 1;
datalen = in->used - offset;
- node = get_node_canonicalized(conn, in, vec[0], &name, XS_PERM_WRITE);
+ node = get_node_canonicalized(conn, ctx, vec[0], &name, XS_PERM_WRITE);
if (!node) {
/* No permissions, invalid input? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, in->buffer + offset,
+ node = create_node(conn, ctx, name, in->buffer + offset,
datalen);
if (!node)
return errno;
@@ -1506,18 +1512,19 @@ static int do_write(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
send_ack(conn, XS_WRITE);
return 0;
}
-static int do_mkdir(struct connection *conn, struct buffered_data *in)
+static int do_mkdir(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *name;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
/* If it already exists, fine. */
@@ -1527,10 +1534,10 @@ static int do_mkdir(struct connection *conn, struct buffered_data *in)
return errno;
if (!name)
return ENOMEM;
- node = create_node(conn, in, name, NULL, 0);
+ node = create_node(conn, ctx, name, NULL, 0);
if (!node)
return errno;
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
}
send_ack(conn, XS_MKDIR);
@@ -1628,24 +1635,25 @@ static int _rm(struct connection *conn, const void *ctx, struct node *node,
}
-static int do_rm(struct connection *conn, struct buffered_data *in)
+static int do_rm(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
int ret;
char *name;
char *parentname;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
if (!node) {
/* Didn't exist already? Fine, if parent exists. */
if (errno == ENOENT) {
if (!name)
return ENOMEM;
- parentname = get_parent(in, name);
+ parentname = get_parent(ctx, name);
if (!parentname)
return errno;
- node = read_node(conn, in, parentname);
+ node = read_node(conn, ctx, parentname);
if (node) {
send_ack(conn, XS_RM);
return 0;
@@ -1660,7 +1668,7 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
if (streq(name, "/"))
return EINVAL;
- ret = _rm(conn, in, node, name);
+ ret = _rm(conn, ctx, node, name);
if (ret)
return ret;
@@ -1670,13 +1678,15 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
}
-static int do_get_perms(struct connection *conn, struct buffered_data *in)
+static int do_get_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *strings;
unsigned int len;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1689,7 +1699,8 @@ static int do_get_perms(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int do_set_perms(struct connection *conn, struct buffered_data *in)
+static int do_set_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node_perms perms, old_perms;
char *name, *permstr;
@@ -1706,7 +1717,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
permstr = in->buffer + strlen(in->buffer) + 1;
- perms.p = talloc_array(in, struct xs_permissions, perms.num);
+ perms.p = talloc_array(ctx, struct xs_permissions, perms.num);
if (!perms.p)
return ENOMEM;
if (!xs_strings_to_perms(perms.p, perms.num, permstr))
@@ -1721,7 +1732,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
}
/* We must own node to do this (tools can do this too). */
- node = get_node_canonicalized(conn, in, in->buffer, &name,
+ node = get_node_canonicalized(conn, ctx, in->buffer, &name,
XS_PERM_WRITE | XS_PERM_OWNER);
if (!node)
return errno;
@@ -1756,7 +1767,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, &old_perms);
+ fire_watches(conn, ctx, name, node, false, &old_perms);
send_ack(conn, XS_SET_PERMS);
return 0;
@@ -1764,7 +1775,8 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
static struct {
const char *str;
- int (*func)(struct connection *conn, struct buffered_data *in);
+ int (*func)(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
unsigned int flags;
#define XS_FLAG_NOTID (1U << 0) /* Ignore transaction id. */
#define XS_FLAG_PRIV (1U << 1) /* Privileged domain only. */
@@ -1840,6 +1852,7 @@ static void process_message(struct connection *conn, struct buffered_data *in)
struct transaction *trans;
enum xsd_sockmsg_type type = in->hdr.msg.type;
int ret;
+ void *ctx;
if ((unsigned int)type >= XS_TYPE_COUNT || !wire_funcs[type].func) {
eprintf("Client unknown operation %i", type);
@@ -1860,10 +1873,17 @@ static void process_message(struct connection *conn, struct buffered_data *in)
return;
}
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ send_error(conn, ENOMEM);
+ return;
+ }
+
assert(conn->transaction == NULL);
conn->transaction = trans;
- ret = wire_funcs[type].func(conn, in);
+ ret = wire_funcs[type].func(ctx, conn, in);
+ talloc_free(ctx);
if (ret)
send_error(conn, ret);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index 3d5142581332..d262f4e9dbdf 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -336,7 +336,7 @@ bool domain_can_write(struct connection *conn)
return ((intf->rsp_prod - intf->rsp_cons) != XENSTORE_RING_SIZE);
}
-static char *talloc_domain_path(void *context, unsigned int domid)
+static char *talloc_domain_path(const void *context, unsigned int domid)
{
return talloc_asprintf(context, "/local/domain/%u", domid);
}
@@ -540,7 +540,8 @@ static struct domain *introduce_domain(const void *ctx,
}
/* domid, gfn, evtchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in)
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
char *vec[3];
@@ -558,7 +559,7 @@ int do_introduce(struct connection *conn, struct buffered_data *in)
if (port <= 0)
return EINVAL;
- domain = introduce_domain(in, domid, port, false);
+ domain = introduce_domain(ctx, domid, port, false);
if (!domain)
return errno;
@@ -581,7 +582,8 @@ static struct domain *find_connected_domain(unsigned int domid)
return domain;
}
-int do_set_target(struct connection *conn, struct buffered_data *in)
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *vec[2];
unsigned int domid, tdomid;
@@ -625,7 +627,8 @@ static struct domain *onearg_domain(struct connection *conn,
}
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in)
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -640,7 +643,8 @@ int do_release(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_resume(struct connection *conn, struct buffered_data *in)
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -655,7 +659,8 @@ int do_resume(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_get_domain_path(struct connection *conn, struct buffered_data *in)
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *path;
const char *domid_str = onearg(in);
@@ -663,18 +668,17 @@ int do_get_domain_path(struct connection *conn, struct buffered_data *in)
if (!domid_str)
return EINVAL;
- path = talloc_domain_path(conn, atoi(domid_str));
+ path = talloc_domain_path(ctx, atoi(domid_str));
if (!path)
return errno;
send_reply(conn, XS_GET_DOMAIN_PATH, path, strlen(path) + 1);
- talloc_free(path);
-
return 0;
}
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int result;
unsigned int domid;
@@ -695,7 +699,8 @@ int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
}
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in)
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
conn_delete_all_watches(conn);
conn_delete_all_transactions(conn);
diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
index 0f883936f413..da513443cd46 100644
--- a/tools/xenstore/xenstored_domain.h
+++ b/tools/xenstore/xenstored_domain.h
@@ -24,25 +24,32 @@ void handle_event(void);
void check_domains(bool restore);
/* domid, mfn, eventchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in);
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in);
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in);
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_resume(struct connection *conn, struct buffered_data *in);
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid, target */
-int do_set_target(struct connection *conn, struct buffered_data *in);
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_get_domain_path(struct connection *conn, struct buffered_data *in);
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in);
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void domain_init(int evtfd);
void dom0_init(void);
diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 28774813de83..3e3eb47326cc 100644
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -481,7 +481,8 @@ struct transaction *transaction_lookup(struct connection *conn, uint32_t id)
return ERR_PTR(-ENOENT);
}
-int do_transaction_start(struct connection *conn, struct buffered_data *in)
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct transaction *trans, *exists;
char id_str[20];
@@ -494,8 +495,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
conn->transaction_started > quota_max_transaction)
return ENOSPC;
- /* Attach transaction to input for autofree until it's complete */
- trans = talloc_zero(in, struct transaction);
+ /* Attach transaction to ctx for autofree until it's complete */
+ trans = talloc_zero(ctx, struct transaction);
if (!trans)
return ENOMEM;
@@ -544,7 +545,8 @@ static int transaction_fix_domains(struct transaction *trans, bool update)
return 0;
}
-int do_transaction_end(struct connection *conn, struct buffered_data *in)
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
const char *arg = onearg(in);
struct transaction *trans;
@@ -562,8 +564,8 @@ int do_transaction_end(struct connection *conn, struct buffered_data *in)
if (!conn->transaction_started)
conn->ta_start_time = 0;
- /* Attach transaction to in for auto-cleanup */
- talloc_steal(in, trans);
+ /* Attach transaction to ctx for auto-cleanup */
+ talloc_steal(ctx, trans);
if (streq(arg, "T")) {
if (trans->fail)
diff --git a/tools/xenstore/xenstored_transaction.h b/tools/xenstore/xenstored_transaction.h
index e3cbd6b23095..39d7f81c5127 100644
--- a/tools/xenstore/xenstored_transaction.h
+++ b/tools/xenstore/xenstored_transaction.h
@@ -29,8 +29,10 @@ struct transaction;
extern uint64_t generation;
-int do_transaction_start(struct connection *conn, struct buffered_data *node);
-int do_transaction_end(struct connection *conn, struct buffered_data *in);
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *node);
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
struct transaction *transaction_lookup(struct connection *conn, uint32_t id);
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 4970e9f1a1b9..854bbcad6e45 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -243,7 +243,7 @@ static struct watch *add_watch(struct connection *conn, char *path, char *token,
return NULL;
}
-int do_watch(struct connection *conn, struct buffered_data *in)
+int do_watch(const void *ctx, struct connection *conn, struct buffered_data *in)
{
struct watch *watch;
char *vec[2];
@@ -252,7 +252,7 @@ int do_watch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- errno = check_watch_path(conn, in, &(vec[0]), &relative);
+ errno = check_watch_path(conn, ctx, &(vec[0]), &relative);
if (errno)
return errno;
@@ -283,7 +283,8 @@ int do_watch(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_unwatch(struct connection *conn, struct buffered_data *in)
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct watch *watch;
char *node, *vec[2];
@@ -291,7 +292,7 @@ int do_unwatch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- node = canonicalize(conn, in, vec[0]);
+ node = canonicalize(conn, ctx, vec[0]);
if (!node)
return ENOMEM;
list_for_each_entry(watch, &conn->watches, list) {
diff --git a/tools/xenstore/xenstored_watch.h b/tools/xenstore/xenstored_watch.h
index 0e693f0839cd..091890edca96 100644
--- a/tools/xenstore/xenstored_watch.h
+++ b/tools/xenstore/xenstored_watch.h
@@ -21,8 +21,10 @@
#include "xenstored_core.h"
-int do_watch(struct connection *conn, struct buffered_data *in);
-int do_unwatch(struct connection *conn, struct buffered_data *in);
+int do_watch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Fire all watches: !exact means all the children are affected (ie. rm). */
void fire_watches(struct connection *conn, const void *tmp, const char *name,
From 80d128b14482d2e9342184d2d9949367851c4d14 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 13 Sep 2022 07:35:10 +0200
Subject: tools/xenstore: don't use conn->in as context for temporary
allocations
Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.
As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").
Some sub-functions need to gain the "const" attribute for the talloc
context.
This is XSA-416 / CVE-2022-42319.
Reported-by: Julien Grall <jgrall@amazon.com>
Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index 1031a81c3874..d0350c6ad861 100644
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -155,7 +155,7 @@ bool lu_is_pending(void)
struct cmd_s {
char *cmd;
- int (*func)(void *, struct connection *, char **, int);
+ int (*func)(const void *, struct connection *, char **, int);
char *pars;
/*
* max_pars can be used to limit the size of the parameter vector,
@@ -167,7 +167,7 @@ struct cmd_s {
unsigned int max_pars;
};
-static int do_control_check(void *ctx, struct connection *conn,
+static int do_control_check(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -179,7 +179,7 @@ static int do_control_check(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_log(void *ctx, struct connection *conn,
+static int do_control_log(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -281,7 +281,7 @@ static int quota_get(const void *ctx, struct connection *conn,
return domain_get_quota(ctx, conn, atoi(vec[0]));
}
-static int do_control_quota(void *ctx, struct connection *conn,
+static int do_control_quota(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -293,7 +293,7 @@ static int do_control_quota(void *ctx, struct connection *conn,
return quota_get(ctx, conn, vec, num);
}
-static int do_control_quota_s(void *ctx, struct connection *conn,
+static int do_control_quota_s(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num == 0)
@@ -306,7 +306,7 @@ static int do_control_quota_s(void *ctx, struct connection *conn,
}
#ifdef __MINIOS__
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num)
@@ -318,7 +318,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
return 0;
}
#else
-static int do_control_logfile(void *ctx, struct connection *conn,
+static int do_control_logfile(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -333,7 +333,7 @@ static int do_control_logfile(void *ctx, struct connection *conn,
return 0;
}
-static int do_control_memreport(void *ctx, struct connection *conn,
+static int do_control_memreport(const void *ctx, struct connection *conn,
char **vec, int num)
{
FILE *fp;
@@ -373,7 +373,7 @@ static int do_control_memreport(void *ctx, struct connection *conn,
}
#endif
-static int do_control_print(void *ctx, struct connection *conn,
+static int do_control_print(const void *ctx, struct connection *conn,
char **vec, int num)
{
if (num != 1)
@@ -875,7 +875,7 @@ static const char *lu_start(const void *ctx, struct connection *conn,
return NULL;
}
-static int do_control_lu(void *ctx, struct connection *conn,
+static int do_control_lu(const void *ctx, struct connection *conn,
char **vec, int num)
{
const char *ret = NULL;
@@ -922,7 +922,7 @@ static int do_control_lu(void *ctx, struct connection *conn,
}
#endif
-static int do_control_help(void *, struct connection *, char **, int);
+static int do_control_help(const void *, struct connection *, char **, int);
static struct cmd_s cmds[] = {
{ "check", do_control_check, "" },
@@ -961,7 +961,7 @@ static struct cmd_s cmds[] = {
{ "help", do_control_help, "" },
};
-static int do_control_help(void *ctx, struct connection *conn,
+static int do_control_help(const void *ctx, struct connection *conn,
char **vec, int num)
{
int cmd, len = 0;
@@ -997,7 +997,8 @@ static int do_control_help(void *ctx, struct connection *conn,
return 0;
}
-int do_control(struct connection *conn, struct buffered_data *in)
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int cmd, num, off;
char **vec = NULL;
@@ -1017,11 +1018,11 @@ int do_control(struct connection *conn, struct buffered_data *in)
num = xs_count_strings(in->buffer, in->used);
if (cmds[cmd].max_pars)
num = min(num, cmds[cmd].max_pars);
- vec = talloc_array(in, char *, num);
+ vec = talloc_array(ctx, char *, num);
if (!vec)
return ENOMEM;
if (get_strings(in, vec, num) < num)
return EIO;
- return cmds[cmd].func(in, conn, vec + 1, num - 1);
+ return cmds[cmd].func(ctx, conn, vec + 1, num - 1);
}
diff --git a/tools/xenstore/xenstored_control.h b/tools/xenstore/xenstored_control.h
index 98b6fbcea2b1..a8cb76559ba1 100644
--- a/tools/xenstore/xenstored_control.h
+++ b/tools/xenstore/xenstored_control.h
@@ -16,7 +16,8 @@
along with this program; If not, see <http://www.gnu.org/licenses/>.
*/
-int do_control(struct connection *conn, struct buffered_data *in);
+int do_control(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void lu_read_state(void);
struct connection *lu_get_connection(void);
diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 16504de42017..411cc0e44714 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1248,11 +1248,13 @@ static struct node *get_node_canonicalized(struct connection *conn,
return get_node(conn, ctx, *canonical_name, perm);
}
-static int send_directory(struct connection *conn, struct buffered_data *in)
+static int send_directory(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1261,7 +1263,7 @@ static int send_directory(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int send_directory_part(struct connection *conn,
+static int send_directory_part(const void *ctx, struct connection *conn,
struct buffered_data *in)
{
unsigned int off, len, maxlen, genlen;
@@ -1273,7 +1275,8 @@ static int send_directory_part(struct connection *conn,
return EINVAL;
/* First arg is node name. */
- node = get_node_canonicalized(conn, in, in->buffer, NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, in->buffer, NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1300,7 +1303,7 @@ static int send_directory_part(struct connection *conn,
break;
}
- data = talloc_array(in, char, genlen + len + 1);
+ data = talloc_array(ctx, char, genlen + len + 1);
if (!data)
return ENOMEM;
@@ -1316,11 +1319,13 @@ static int send_directory_part(struct connection *conn,
return 0;
}
-static int do_read(struct connection *conn, struct buffered_data *in)
+static int do_read(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1510,7 +1515,8 @@ static struct node *create_node(struct connection *conn, const void *ctx,
}
/* path, data... */
-static int do_write(struct connection *conn, struct buffered_data *in)
+static int do_write(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
unsigned int offset, datalen;
struct node *node;
@@ -1524,12 +1530,12 @@ static int do_write(struct connection *conn, struct buffered_data *in)
offset = strlen(vec[0]) + 1;
datalen = in->used - offset;
- node = get_node_canonicalized(conn, in, vec[0], &name, XS_PERM_WRITE);
+ node = get_node_canonicalized(conn, ctx, vec[0], &name, XS_PERM_WRITE);
if (!node) {
/* No permissions, invalid input? */
if (errno != ENOENT)
return errno;
- node = create_node(conn, in, name, in->buffer + offset,
+ node = create_node(conn, ctx, name, in->buffer + offset,
datalen);
if (!node)
return errno;
@@ -1540,18 +1546,19 @@ static int do_write(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
send_ack(conn, XS_WRITE);
return 0;
}
-static int do_mkdir(struct connection *conn, struct buffered_data *in)
+static int do_mkdir(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *name;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
/* If it already exists, fine. */
@@ -1561,10 +1568,10 @@ static int do_mkdir(struct connection *conn, struct buffered_data *in)
return errno;
if (!name)
return ENOMEM;
- node = create_node(conn, in, name, NULL, 0);
+ node = create_node(conn, ctx, name, NULL, 0);
if (!node)
return errno;
- fire_watches(conn, in, name, node, false, NULL);
+ fire_watches(conn, ctx, name, node, false, NULL);
}
send_ack(conn, XS_MKDIR);
@@ -1662,24 +1669,25 @@ static int _rm(struct connection *conn, const void *ctx, struct node *node,
}
-static int do_rm(struct connection *conn, struct buffered_data *in)
+static int do_rm(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
int ret;
char *name;
char *parentname;
- node = get_node_canonicalized(conn, in, onearg(in), &name,
+ node = get_node_canonicalized(conn, ctx, onearg(in), &name,
XS_PERM_WRITE);
if (!node) {
/* Didn't exist already? Fine, if parent exists. */
if (errno == ENOENT) {
if (!name)
return ENOMEM;
- parentname = get_parent(in, name);
+ parentname = get_parent(ctx, name);
if (!parentname)
return errno;
- node = read_node(conn, in, parentname);
+ node = read_node(conn, ctx, parentname);
if (node) {
send_ack(conn, XS_RM);
return 0;
@@ -1694,7 +1702,7 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
if (streq(name, "/"))
return EINVAL;
- ret = _rm(conn, in, node, name);
+ ret = _rm(conn, ctx, node, name);
if (ret)
return ret;
@@ -1704,13 +1712,15 @@ static int do_rm(struct connection *conn, struct buffered_data *in)
}
-static int do_get_perms(struct connection *conn, struct buffered_data *in)
+static int do_get_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node *node;
char *strings;
unsigned int len;
- node = get_node_canonicalized(conn, in, onearg(in), NULL, XS_PERM_READ);
+ node = get_node_canonicalized(conn, ctx, onearg(in), NULL,
+ XS_PERM_READ);
if (!node)
return errno;
@@ -1723,7 +1733,8 @@ static int do_get_perms(struct connection *conn, struct buffered_data *in)
return 0;
}
-static int do_set_perms(struct connection *conn, struct buffered_data *in)
+static int do_set_perms(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct node_perms perms, old_perms;
char *name, *permstr;
@@ -1740,7 +1751,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
permstr = in->buffer + strlen(in->buffer) + 1;
- perms.p = talloc_array(in, struct xs_permissions, perms.num);
+ perms.p = talloc_array(ctx, struct xs_permissions, perms.num);
if (!perms.p)
return ENOMEM;
if (!xs_strings_to_perms(perms.p, perms.num, permstr))
@@ -1755,7 +1766,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
}
/* We must own node to do this (tools can do this too). */
- node = get_node_canonicalized(conn, in, in->buffer, &name,
+ node = get_node_canonicalized(conn, ctx, in->buffer, &name,
XS_PERM_WRITE | XS_PERM_OWNER);
if (!node)
return errno;
@@ -1790,7 +1801,7 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
return errno;
}
- fire_watches(conn, in, name, node, false, &old_perms);
+ fire_watches(conn, ctx, name, node, false, &old_perms);
send_ack(conn, XS_SET_PERMS);
return 0;
@@ -1798,7 +1809,8 @@ static int do_set_perms(struct connection *conn, struct buffered_data *in)
static struct {
const char *str;
- int (*func)(struct connection *conn, struct buffered_data *in);
+ int (*func)(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
unsigned int flags;
#define XS_FLAG_NOTID (1U << 0) /* Ignore transaction id. */
#define XS_FLAG_PRIV (1U << 1) /* Privileged domain only. */
@@ -1874,6 +1886,7 @@ static void process_message(struct connection *conn, struct buffered_data *in)
struct transaction *trans;
enum xsd_sockmsg_type type = in->hdr.msg.type;
int ret;
+ void *ctx;
/* At least send_error() and send_reply() expects conn->in == in */
assert(conn->in == in);
@@ -1898,10 +1911,17 @@ static void process_message(struct connection *conn, struct buffered_data *in)
return;
}
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ send_error(conn, ENOMEM);
+ return;
+ }
+
assert(conn->transaction == NULL);
conn->transaction = trans;
- ret = wire_funcs[type].func(conn, in);
+ ret = wire_funcs[type].func(ctx, conn, in);
+ talloc_free(ctx);
if (ret)
send_error(conn, ret);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index e7c6886ccf47..fb732d0a14c3 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -330,7 +330,7 @@ bool domain_is_unprivileged(struct connection *conn)
domid_is_unprivileged(conn->domain->domid);
}
-static char *talloc_domain_path(void *context, unsigned int domid)
+static char *talloc_domain_path(const void *context, unsigned int domid)
{
return talloc_asprintf(context, "/local/domain/%u", domid);
}
@@ -534,7 +534,8 @@ static struct domain *introduce_domain(const void *ctx,
}
/* domid, gfn, evtchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in)
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
char *vec[3];
@@ -552,7 +553,7 @@ int do_introduce(struct connection *conn, struct buffered_data *in)
if (port <= 0)
return EINVAL;
- domain = introduce_domain(in, domid, port, false);
+ domain = introduce_domain(ctx, domid, port, false);
if (!domain)
return errno;
@@ -575,7 +576,8 @@ static struct domain *find_connected_domain(unsigned int domid)
return domain;
}
-int do_set_target(struct connection *conn, struct buffered_data *in)
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *vec[2];
unsigned int domid, tdomid;
@@ -619,7 +621,8 @@ static struct domain *onearg_domain(struct connection *conn,
}
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in)
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -634,7 +637,8 @@ int do_release(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_resume(struct connection *conn, struct buffered_data *in)
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct domain *domain;
@@ -649,7 +653,8 @@ int do_resume(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_get_domain_path(struct connection *conn, struct buffered_data *in)
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
char *path;
const char *domid_str = onearg(in);
@@ -657,18 +662,17 @@ int do_get_domain_path(struct connection *conn, struct buffered_data *in)
if (!domid_str)
return EINVAL;
- path = talloc_domain_path(conn, atoi(domid_str));
+ path = talloc_domain_path(ctx, atoi(domid_str));
if (!path)
return errno;
send_reply(conn, XS_GET_DOMAIN_PATH, path, strlen(path) + 1);
- talloc_free(path);
-
return 0;
}
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
int result;
unsigned int domid;
@@ -689,7 +693,8 @@ int do_is_domain_introduced(struct connection *conn, struct buffered_data *in)
}
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in)
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
conn_delete_all_watches(conn);
conn_delete_all_transactions(conn);
diff --git a/tools/xenstore/xenstored_domain.h b/tools/xenstore/xenstored_domain.h
index 904faa923afb..b9e152890149 100644
--- a/tools/xenstore/xenstored_domain.h
+++ b/tools/xenstore/xenstored_domain.h
@@ -24,25 +24,32 @@ void handle_event(void);
void check_domains(void);
/* domid, mfn, eventchn, path */
-int do_introduce(struct connection *conn, struct buffered_data *in);
+int do_introduce(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_is_domain_introduced(struct connection *conn, struct buffered_data *in);
+int do_is_domain_introduced(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_release(struct connection *conn, struct buffered_data *in);
+int do_release(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_resume(struct connection *conn, struct buffered_data *in);
+int do_resume(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid, target */
-int do_set_target(struct connection *conn, struct buffered_data *in);
+int do_set_target(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* domid */
-int do_get_domain_path(struct connection *conn, struct buffered_data *in);
+int do_get_domain_path(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Allow guest to reset all watches */
-int do_reset_watches(struct connection *conn, struct buffered_data *in);
+int do_reset_watches(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
void domain_init(int evtfd);
void dom0_init(void);
diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 28774813de83..3e3eb47326cc 100644
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -481,7 +481,8 @@ struct transaction *transaction_lookup(struct connection *conn, uint32_t id)
return ERR_PTR(-ENOENT);
}
-int do_transaction_start(struct connection *conn, struct buffered_data *in)
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct transaction *trans, *exists;
char id_str[20];
@@ -494,8 +495,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
conn->transaction_started > quota_max_transaction)
return ENOSPC;
- /* Attach transaction to input for autofree until it's complete */
- trans = talloc_zero(in, struct transaction);
+ /* Attach transaction to ctx for autofree until it's complete */
+ trans = talloc_zero(ctx, struct transaction);
if (!trans)
return ENOMEM;
@@ -544,7 +545,8 @@ static int transaction_fix_domains(struct transaction *trans, bool update)
return 0;
}
-int do_transaction_end(struct connection *conn, struct buffered_data *in)
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
const char *arg = onearg(in);
struct transaction *trans;
@@ -562,8 +564,8 @@ int do_transaction_end(struct connection *conn, struct buffered_data *in)
if (!conn->transaction_started)
conn->ta_start_time = 0;
- /* Attach transaction to in for auto-cleanup */
- talloc_steal(in, trans);
+ /* Attach transaction to ctx for auto-cleanup */
+ talloc_steal(ctx, trans);
if (streq(arg, "T")) {
if (trans->fail)
diff --git a/tools/xenstore/xenstored_transaction.h b/tools/xenstore/xenstored_transaction.h
index e3cbd6b23095..39d7f81c5127 100644
--- a/tools/xenstore/xenstored_transaction.h
+++ b/tools/xenstore/xenstored_transaction.h
@@ -29,8 +29,10 @@ struct transaction;
extern uint64_t generation;
-int do_transaction_start(struct connection *conn, struct buffered_data *node);
-int do_transaction_end(struct connection *conn, struct buffered_data *in);
+int do_transaction_start(const void *ctx, struct connection *conn,
+ struct buffered_data *node);
+int do_transaction_end(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
struct transaction *transaction_lookup(struct connection *conn, uint32_t id);
diff --git a/tools/xenstore/xenstored_watch.c b/tools/xenstore/xenstored_watch.c
index 85362bcce314..316c08b7f754 100644
--- a/tools/xenstore/xenstored_watch.c
+++ b/tools/xenstore/xenstored_watch.c
@@ -243,7 +243,7 @@ static struct watch *add_watch(struct connection *conn, char *path, char *token,
return NULL;
}
-int do_watch(struct connection *conn, struct buffered_data *in)
+int do_watch(const void *ctx, struct connection *conn, struct buffered_data *in)
{
struct watch *watch;
char *vec[2];
@@ -252,7 +252,7 @@ int do_watch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- errno = check_watch_path(conn, in, &(vec[0]), &relative);
+ errno = check_watch_path(conn, ctx, &(vec[0]), &relative);
if (errno)
return errno;
@@ -283,7 +283,8 @@ int do_watch(struct connection *conn, struct buffered_data *in)
return 0;
}
-int do_unwatch(struct connection *conn, struct buffered_data *in)
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in)
{
struct watch *watch;
char *node, *vec[2];
@@ -291,7 +292,7 @@ int do_unwatch(struct connection *conn, struct buffered_data *in)
if (get_strings(in, vec, ARRAY_SIZE(vec)) != ARRAY_SIZE(vec))
return EINVAL;
- node = canonicalize(conn, in, vec[0]);
+ node = canonicalize(conn, ctx, vec[0]);
if (!node)
return ENOMEM;
list_for_each_entry(watch, &conn->watches, list) {
diff --git a/tools/xenstore/xenstored_watch.h b/tools/xenstore/xenstored_watch.h
index 0e693f0839cd..091890edca96 100644
--- a/tools/xenstore/xenstored_watch.h
+++ b/tools/xenstore/xenstored_watch.h
@@ -21,8 +21,10 @@
#include "xenstored_core.h"
-int do_watch(struct connection *conn, struct buffered_data *in);
-int do_unwatch(struct connection *conn, struct buffered_data *in);
+int do_watch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
+int do_unwatch(const void *ctx, struct connection *conn,
+ struct buffered_data *in);
/* Fire all watches: !exact means all the children are affected (ie. rm). */
void fire_watches(struct connection *conn, const void *tmp, const char *name,
© 2016 - 2024 Red Hat, Inc.