xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
From: Wei Liu <wei.liu2@citrix.com>
To: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: xen-devel@lists.xensource.com, Wei Liu <wei.liu2@citrix.com>,
	security@xenproject.org, Jan Beulich <jbeulich@suse.com>
Subject: Re: [PATCH] libxl: Fix NULL pointer due to XSA-178 fix wrong XS nodename
Date: Wed, 8 Jun 2016 16:11:36 +0100	[thread overview]
Message-ID: <20160608151136.GB28116@citrix.com> (raw)
In-Reply-To: <1465397796-652-1-git-send-email-ian.jackson@eu.citrix.com>

On Wed, Jun 08, 2016 at 03:56:36PM +0100, Ian Jackson wrote:
> In "libxl: Do not trust backend for disk eject vdev" (c69871a2fb26 on
> xen.git#staging) we changed libxl_evenable_disk_eject to read the
> device vdev out of xenstore from the /libxl path, rather than the
> backend path, and to read it during setup rather than on each event.
> 
> However, the patch has a mistake:
>     -        GCSPRINTF("%s/dev", backend), NULL);
>     +        GCSPRINTF("%s/vdev", libxl_path), &configured_vdev);
>                            ^
> Spot the extra "v".  This causes configured_vdev always to be NULL.
> configured_vdev is passed to [libxl__]strdup.
> 
> In Xen 4.6 and later libxl__strdup is used and tolerates NULL.
> evg->vdev is set to NULL.  This propagates to the `vdev' field in the
> generated event.  This may or may not cause further trouble, depending
> on the calling application.  In our osstest test cases it does not
> cause any trouble, so the bug goes undetected.
> 
> In Xen 4.5 and earlier, the strdup does not tolerate NULL, and libxl
> crashes immediately.  This has been detected by osstest as a
> regression in Xen 4.5.
> 
> IMO this patch should be applied immediately to
>   xen.git#staging-4.5 (to check that it fixes the osstest regression)
>   xen.git#staging     (to check that it does not break master
> 
> Subject to passes, it should then be propagated to all supported
> stable trees and also be mentioned in an update to XSA-178.
> 
> Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
> CC: security@xenproject.org
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Wei Liu <wei.liu2@citrix.com>

Reviewed-by: Wei Liu <wei.liu2@citrix.com>

> ---
>  tools/libxl/libxl.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
> index 006b83f..7584966 100644
> --- a/tools/libxl/libxl.c
> +++ b/tools/libxl/libxl.c
> @@ -1399,7 +1399,7 @@ int libxl_evenable_disk_eject(libxl_ctx *ctx, uint32_t guest_domid,
>  
>      const char *configured_vdev;
>      rc = libxl__xs_read_checked(gc, XBT_NULL,
> -            GCSPRINTF("%s/vdev", libxl_path), &configured_vdev);
> +            GCSPRINTF("%s/dev", libxl_path), &configured_vdev);
>      if (rc) goto out;
>  
>      evg->vdev = libxl__strdup(NOGC, configured_vdev);
> -- 
> 1.7.10.4
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

  reply	other threads:[~2016-06-08 15:11 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-06-08 14:56 [PATCH] libxl: Fix NULL pointer due to XSA-178 fix wrong XS nodename Ian Jackson
2016-06-08 15:11 ` Wei Liu [this message]
2016-06-08 15:18   ` Ian Jackson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160608151136.GB28116@citrix.com \
    --to=wei.liu2@citrix.com \
    --cc=ian.jackson@eu.citrix.com \
    --cc=jbeulich@suse.com \
    --cc=security@xenproject.org \
    --cc=xen-devel@lists.xensource.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).