From patchwork Mon Jul 24 10:33:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?SsO8cmdlbiBHcm/Dnw==?= X-Patchwork-Id: 13324324 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 30256C0015E for ; Mon, 24 Jul 2023 10:33:50 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.568718.888532 (Exim 4.92) (envelope-from ) id 1qNssn-0003dr-GM; Mon, 24 Jul 2023 10:33:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 568718.888532; Mon, 24 Jul 2023 10:33:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1qNssn-0003dk-DW; Mon, 24 Jul 2023 10:33:41 +0000 Received: by outflank-mailman (input) for mailman id 568718; Mon, 24 Jul 2023 10:33:40 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1qNssm-0003cS-9H for xen-devel@lists.xenproject.org; Mon, 24 Jul 2023 10:33:40 +0000 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 8cf6a66b-2a0d-11ee-8612-37d641c3527e; Mon, 24 Jul 2023 12:33:38 +0200 (CEST) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 399B520661; Mon, 24 Jul 2023 10:33:38 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 0641F138E8; Mon, 24 Jul 2023 10:33:38 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id w60gAIJTvmSIUAAAMHmgww (envelope-from ); Mon, 24 Jul 2023 10:33:38 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 8cf6a66b-2a0d-11ee-8612-37d641c3527e DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1690194818; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=joi8pFR+Pd5xgecdMs2fa+83mlaOI82o45Pbhsckn/E=; b=K8MEtNjc3I4B4iavlfe0JoeBEbufnan4Mw7rSfaAkqgYrJy8rtwHdNXzgmY/ZC5Rg50HjH 8ccOMb+DPhv36nxgkpxQFAIOrnX4BoXmH05EpjVg18Sd6uX5X7XN2SjOoIwzjhDiUe6MB1 Ll/NRUQr6zqt2z81eegjmhrRQTypUhQ= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: Juergen Gross , Wei Liu , Julien Grall , Anthony PERARD , Julien Grall Subject: [PATCH v3 2/2] tools/xenstore: fix get_spec_node() Date: Mon, 24 Jul 2023 12:33:24 +0200 Message-Id: <20230724103324.4207-3-jgross@suse.com> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20230724103324.4207-1-jgross@suse.com> References: <20230724103324.4207-1-jgross@suse.com> MIME-Version: 1.0 In case get_spec_node() is being called for a special node starting with '@' it won't set *canonical_name. This can result in a crash of xenstored due to dereferencing the uninitialized name in fire_watches(). This is no security issue as it requires either a privileged caller or ownership of the special node in question by an unprivileged caller (which is questionable, as this would make the owner privileged in some way). Fixes: d6bb63924fc2 ("tools/xenstore: introduce dummy nodes for special watch paths") Signed-off-by: Juergen Gross Reviewed-by: Julien Grall --- V2: - avoid casting const away (Julien Grall) --- tools/xenstore/xenstored_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c index 6d27b2dd7f..9f1328a31f 100644 --- a/tools/xenstore/xenstored_core.c +++ b/tools/xenstore/xenstored_core.c @@ -1253,8 +1253,11 @@ static struct node *get_spec_node(struct connection *conn, const void *ctx, const char *name, const char **canonical_name, unsigned int perm) { - if (name[0] == '@') + if (name[0] == '@') { + if (canonical_name) + *canonical_name = name; return get_node(conn, ctx, name, perm); + } return get_node_canonicalized(conn, ctx, name, canonical_name, perm); }