]> xenbits.xensource.com Git - xen.git/commit
tools/xenstore: fix a use after free problem in xenstored
authorJuergen Gross <jgross@suse.com>
Fri, 3 Apr 2020 12:03:40 +0000 (13:03 +0100)
committerIan Jackson <ian.jackson@eu.citrix.com>
Tue, 5 May 2020 14:35:54 +0000 (15:35 +0100)
commitdc5176d0f9434e275e0be1df8d0518e243798beb
treecdc4e48dc54e1a6d09d6cbd48cfa37b23772e002
parent48f4d695ee5713a25fc383d669b6142fbcbb7e20
tools/xenstore: fix a use after free problem in xenstored

Commit 562a1c0f7ef3fb ("tools/xenstore: dont unlink connection object
twice") introduced a potential use after free problem in
domain_cleanup(): after calling talloc_unlink() for domain->conn
domain->conn is set to NULL. The problem is that domain is registered
as talloc child of domain->conn, so it might be freed by the
talloc_unlink() call.

With Xenstore being single threaded there are normally no concurrent
memory allocations running and freeing a virtual memory area normally
doesn't result in that area no longer being accessible. A problem
could occur only in case either a signal received results in some
memory allocation done in the signal handler (SIGHUP is a primary
candidate leading to reopening the log file), or in case the talloc
framework would do some internal memory allocation during freeing of
the memory (which would lead to clobbering of the freed domain
structure).

Fixes: 562a1c0f7ef3fb ("tools/xenstore: dont unlink connection object twice")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
(cherry picked from commit bb2a34fd740e9a26be9e2244f1a5b4cef439e5a8)
tools/xenstore/xenstored_domain.c