tools/ocaml: Ensure packet size is never negative

Integers in Ocaml have 63 or 31 bits of signed precision.

On 64-bit builds of Ocaml, this is fine because a C uint32_t always fits
within a 63-bit signed integer.

In 32-bit builds of Ocaml, this goes wrong.  The C uint32_t is truncated
first (loses the top bit), then has a unsigned/signed mismatch.

A "negative" value (i.e. a packet on the ring of between 1G and 2G in size)
will trigger an exception later in Bytes.make in xb.ml, and because the packet
is not removed from the ring, the exception re-triggers on every subsequent
query, creating a livelock.

Fix both the source of the exception in Xb, and as defence in depth, mark the
domain as bad for any Invalid_argument exceptions to avoid the risk of
livelock.

This is XSA-420 / CVE-2022-42324.

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
Acked-by: Christian Lindig <christian.lindig@citrix.com>
(cherry picked from commit ae34df4d82636f4c82700b447ea2c93b9f82b3f3)

diff --git a/tools/ocaml/libs/xb/partial.ml b/tools/ocaml/libs/xb/partial.ml
index b6e2a716e2637488e8c37fb8d6beb4f5e6f79271..3aa8927eb7f04bc1b8ae9e9001a6f0496b8d0183 100644 (file)
--- a/tools/ocaml/libs/xb/partial.ml
+++ b/tools/ocaml/libs/xb/partial.ml
@@ -36,7 +36,7 @@ let of_string s =
           This will leave the guest connection is a bad state and will
           be hard to recover from without restarting the connection
           (ie rebooting the guest) *)
-       let dlen = min xenstore_payload_max dlen in
+       let dlen = max 0 (min xenstore_payload_max dlen) in
        {
                tid = tid;
                rid = rid;
@@ -46,8 +46,8 @@ let of_string s =
        }
 
 let append pkt s sz =
-       if pkt.len > 4096 then failwith "Buffer.add: cannot grow buffer";
-       Buffer.add_string pkt.buf (String.sub s 0 sz)
+       if Buffer.length pkt.buf + sz > xenstore_payload_max then failwith "Buffer.add: cannot grow buffer";
+       Buffer.add_substring pkt.buf s 0 sz
 
 let to_complete pkt =
        pkt.len - (Buffer.length pkt.buf)

diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
index ce39ce28b5f3edcd971739e6ef826cefefb25831..6cb990ee7fb267cd9c19a5c0696becbd03226ff9 100644 (file)
--- a/tools/ocaml/xenstored/process.ml
+++ b/tools/ocaml/xenstored/process.ml
@@ -722,7 +722,7 @@ let do_input store cons doms con =
                        History.reconnect con;
                        info "%s reconnection complete" (Connection.get_domstr con);
                        None
-               | Failure exp ->
+               | Invalid_argument exp | Failure exp ->
                        error "caught exception %s" exp;
                        error "got a bad client %s" (sprintf "%-8s" (Connection.get_domstr con));
                        Connection.mark_as_bad con;