From: Juergen Gross <jgross@suse.com>
To: Julien Grall <julien@xen.org>, xen-devel@lists.xenproject.org
Cc: Julien Grall <jgrall@amazon.com>,
Ian Jackson <iwj@xenproject.org>, Wei Liu <wl@xen.org>
Subject: Re: [PATCH] tools/xenstored: Prevent a buffer overflow in dump_state_node_perms()
Date: Mon, 10 May 2021 09:49:41 +0200 [thread overview]
Message-ID: <f9542104-b645-4d94-5aab-0854e4b54ff0@suse.com> (raw)
In-Reply-To: <20210506161223.15984-1-julien@xen.org>
[-- Attachment #1.1.1: Type: text/plain, Size: 1990 bytes --]
On 06.05.21 18:12, Julien Grall wrote:
> From: Julien Grall <jgrall@amazon.com>
>
> ASAN reported one issue when Live Updating Xenstored:
>
> =================================================================
> ==873==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc194f53e0 at pc 0x555c6b323292 bp 0x7ffc194f5340 sp 0x7ffc194f5338
> WRITE of size 1 at 0x7ffc194f53e0 thread T0
> #0 0x555c6b323291 in dump_state_node_perms xen/tools/xenstore/xenstored_core.c:2468
> #1 0x555c6b32746e in dump_state_special_node xen/tools/xenstore/xenstored_domain.c:1257
> #2 0x555c6b32a702 in dump_state_special_nodes xen/tools/xenstore/xenstored_domain.c:1273
> #3 0x555c6b32ddb3 in lu_dump_state xen/tools/xenstore/xenstored_control.c:521
> #4 0x555c6b32e380 in do_lu_start xen/tools/xenstore/xenstored_control.c:660
> #5 0x555c6b31b461 in call_delayed xen/tools/xenstore/xenstored_core.c:278
> #6 0x555c6b32275e in main xen/tools/xenstore/xenstored_core.c:2357
> #7 0x7f95eecf3d09 in __libc_start_main ../csu/libc-start.c:308
> #8 0x555c6b3197e9 in _start (/usr/local/sbin/xenstored+0xc7e9)
>
> Address 0x7ffc194f53e0 is located in stack of thread T0 at offset 80 in frame
> #0 0x555c6b32713e in dump_state_special_node xen/tools/xenstore/xenstored_domain.c:1232
>
> This frame has 2 object(s):
> [32, 40) 'head' (line 1233)
> [64, 80) 'sn' (line 1234) <== Memory access at offset 80 overflows this variable
>
> This is happening because the callers are passing a pointer to a variable
> allocated on the stack. However, the field perms is a dynamic array, so
> Xenstored will end up to read outside of the variable.
>
> Rework the code so the permissions are written one by one in the fd.
>
> Fixes: ed6eebf17d2c ("tools/xenstore: dump the xenstore state for live update")
> Signed-off-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Juergen
[-- Attachment #1.1.2: OpenPGP_0xB0DE9DD628BF132F.asc --]
[-- Type: application/pgp-keys, Size: 3135 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
next prev parent reply other threads:[~2021-05-10 7:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-06 16:12 [PATCH] tools/xenstored: Prevent a buffer overflow in dump_state_node_perms() Julien Grall
2021-05-07 15:45 ` Luca Fancellu
2021-05-10 7:49 ` Juergen Gross [this message]
2021-05-10 17:27 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f9542104-b645-4d94-5aab-0854e4b54ff0@suse.com \
--to=jgross@suse.com \
--cc=iwj@xenproject.org \
--cc=jgrall@amazon.com \
--cc=julien@xen.org \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).