File xsa178-0008-libxl-Do-not-trust-backend-for-disk... of Package xen.6738

Overview Repositories Revisions Requests Users Attributes Meta

File xsa178-0008-libxl-Do-not-trust-backend-for-disk-in-getinfo.patch of Package xen.6738

References: bsc#979670 CVE-2016-4963 XSA-178

From 4e47263f25956f015ce8054c37473511c066a0b1 Mon Sep 17 00:00:00 2001
From: Ian Jackson <ian.jackson@eu.citrix.com>
Date: Fri, 29 Apr 2016 19:10:45 +0100
Subject: [PATCH 08/21] libxl: Do not trust backend for disk in getinfo

Do not read the frontend path out of the backend.  We have it in our
hand.  Likewise the guest (frontend) domid was one of our parameters (!)

This is part of XSA-178.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
---
 tools/libxl/libxl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Index: xen-4.4.4-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.4-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.4-testing/tools/libxl/libxl.c
@@ -2497,9 +2497,8 @@ int libxl_device_disk_getinfo(libxl_ctx
     val = libxl__xs_read(gc, XBT_NULL, GCSPRINTF("%s/ring-ref", fe_path));
     diskinfo->rref = val ? strtoul(val, NULL, 10) : -1;
     diskinfo->frontend = xs_read(ctx->xsh, XBT_NULL,
-                                 libxl__sprintf(gc, "%s/frontend", diskinfo->backend), NULL);
-    val = libxl__xs_read(gc, XBT_NULL, libxl__sprintf(gc, "%s/frontend-id", diskinfo->backend));
-    diskinfo->frontend_id = val ? strtoul(val, NULL, 10) : -1;
+                                 GCSPRINTF("%s/frontend", libxl_path), NULL);
+    diskinfo->frontend_id = domid;
 
     GC_FREE;
     return 0;

Places

File xsa178-0008-libxl-Do-not-trust-backend-for-disk-in-getinfo.patch of Package xen.6738

Places