tools/xenstore: domain can sometimes disappear when destroying connection
PATCH v2 1/1 tools/xenstore: domain can sometimes disappear when destroying connection
There is a circular link formed between domain and a connection. Under certain circumstances, when conn is freed, domain is also freed, which leads to use after free when trying to set the conn field in domain to null.
Signed-off-by Petre Eftime <[email protected]>
--- tools/xenstore/xenstored_domain.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
tools/xenstore/xenstored_domain.c +8 -1
@@ -222,6 +222,7 @@ static void domain_cleanup(void) {xc_dominfo_t dominfo;struct domain *domain; +struct connection *tmp_conn;int notify =0 ; again:
@@ -238,8 +239,14 @@ static void domain_cleanup(void)continue ; }if (domain->conn) { -talloc_unlink (talloc_autofree_context (), domain->conn); +/* +* In certain circumstances conn owns domain and +* domain will be freed when conn is unlinked. +*/ + tmp_conn = domain->conn; domain->conn =NULL ; + +talloc_unlink (talloc_autofree_context (), tmp_conn); notify =0 ;/* destroy_domain() fires the watch */ goto again; }
Signature · 12 lines
2.16.5 Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005. _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel