Skip to contentSkip to conversation

xen: xenbus_dev_frontend: Really return response string

PATCH Applied Simon Gaiser 3 participants 5 messages Mar 15, 2018 – Apr 17, 2018 Xen hypervisor interface

lore
Share & tools
lore

Simon Gaiser

author
#0 lore raw

PATCH 1/1 xen: xenbus_dev_frontend: Really return response string

xenbus_command_reply() did not actually copy the response string and leaked stack content instead.

Fixes 9a6161fe73bd ("xen: return xenstore command failures via response instead of rc")
Signed-off-by Simon Gaiser <[email protected]>

---

PS: AFAICS this is not a security issue since /dev/xen/xenbus is normally only accessible by root and giving xenstore access to a less trusted entity probably has a bunch of other unintended consequences.

 drivers/xen/xenbus/xenbus_dev_frontend.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/xenbus/xenbus_dev_frontend.c +2 -1
index a493e99bed21..845a70fa7f79 100644
@@ -403,7 +403,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u,
 {
 	struct {
 		struct xsd_sockmsg hdr;
-		const char body[16];
+		char body[16];
 	} msg;
 	int rc;
 

@@ -412,6 +412,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u,
 	msg.hdr.len = strlen(reply) + 1;
 	if (msg.hdr.len > sizeof(msg.body))
 		return -E2BIG;
+	memcpy(&msg.body, reply, msg.hdr.len);
 
 	mutex_lock(&u->reply_mutex);
 	rc = queue_reply(&u->read_buffers, &msg, sizeof(msg.hdr) + msg.hdr.len);
Signature · 1 line
2.16.2
Applied
#2 lore raw
Quoted 8 lines · Juergen Gross
Quoted 5 lines · Simon Gaiser

xenbus_command_reply() did not actually copy the response string and leaked stack content instead.

Fixes 9a6161fe73bd ("xen: return xenstore command failures via response instead of rc")
Signed-off-by Simon Gaiser <[email protected]>
Reviewed-by Juergen Gross <[email protected]>

Applied to for-linus-4.17.

-boris

_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel

maintainer Reviewed-by on v1 1/1
#4 lore raw
In reply to Simon Gaiser
Quoted 5 lines · Simon Gaiser

xenbus_command_reply() did not actually copy the response string and leaked stack content instead.

Fixes 9a6161fe73bd ("xen: return xenstore command failures via response instead of rc")
Signed-off-by Simon Gaiser <[email protected]>
Reviewed-by Juergen Gross <[email protected]>

Juergen

_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel