File xsa175-0003-libxl-Do-not-trust-frontend-in-libx... of Package xen.4698

Overview Repositories Revisions Requests Users Attributes Meta

File xsa175-0003-libxl-Do-not-trust-frontend-in-libxl__devices_destro.patch of Package xen.4698

References: bsc#979620 CVE-2016-4962 XSA-175

From 5214e86aec5cce54f6c3621f487df3f1ecb32c52 Mon Sep 17 00:00:00 2001
From: Ian Jackson <ian.jackson@eu.citrix.com>
Date: Tue, 3 May 2016 18:39:36 +0100
Subject: [PATCH 03/12] libxl: Do not trust frontend in libxl__devices_destroy

We need to enumerate the devices we have provided to a domain, without
trusting the guest-writeable (or, at least, guest-deletable) frontend
paths.

Instead, enumerate via, and read the backend path from, /libxl.

The console /libxl path is regular, so the special case for console 0
is not relevant any more: /libxl/GUEST/device/console/0 will be found,
and then libxl__device_destroy will DTRT to the right frontend path.

This is part of XSA-175.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
---
 tools/libxl/libxl_device.c | 22 +++-------------------
 1 file changed, 3 insertions(+), 19 deletions(-)

Index: xen-4.4.4-testing/tools/libxl/libxl_device.c
===================================================================
--- xen-4.4.4-testing.orig/tools/libxl/libxl_device.c
+++ xen-4.4.4-testing/tools/libxl/libxl_device.c
@@ -665,7 +665,7 @@ void libxl__devices_destroy(libxl__egc *
     libxl__multidev_begin(ao, multidev);
     multidev->callback = devices_remove_callback;
 
-    path = GCSPRINTF("/local/domain/%d/device", domid);
+    path = GCSPRINTF("/libxl/%d/device", domid);
     kinds = libxl__xs_directory(gc, XBT_NULL, path, &num_kinds);
     if (!kinds) {
         if (errno != ENOENT) {
@@ -678,12 +678,12 @@ void libxl__devices_destroy(libxl__egc *
         if (libxl__device_kind_from_string(kinds[i], &kind))
             continue;
 
-        path = GCSPRINTF("/local/domain/%d/device/%s", domid, kinds[i]);
+        path = GCSPRINTF("/libxl/%d/device/%s", domid, kinds[i]);
         devs = libxl__xs_directory(gc, XBT_NULL, path, &num_dev_xsentries);
         if (!devs)
             continue;
         for (j = 0; j < num_dev_xsentries; j++) {
-            path = GCSPRINTF("/local/domain/%d/device/%s/%s/backend",
+            path = GCSPRINTF("/libxl/%d/device/%s/%s/backend",
                              domid, kinds[i], devs[j]);
             path = libxl__xs_read(gc, XBT_NULL, path);
             GCNEW(dev);
@@ -708,22 +708,6 @@ void libxl__devices_destroy(libxl__egc *
         }
     }
 
-    /* console 0 frontend directory is not under /local/domain/<domid>/device */
-    path = GCSPRINTF("/local/domain/%d/console/backend", domid);
-    path = libxl__xs_read(gc, XBT_NULL, path);
-    GCNEW(dev);
-    if (path && strcmp(path, "") &&
-        libxl__parse_backend_path(gc, path, dev) == 0) {
-        dev->domid = domid;
-        dev->kind = LIBXL__DEVICE_KIND_CONSOLE;
-        dev->devid = 0;
-
-        /* Currently console devices can be destroyed synchronously by just
-         * removing xenstore entries, this is what libxl__device_destroy does.
-         */
-        libxl__device_destroy(gc, dev);
-    }
-
 out:
     libxl__multidev_prepared(egc, multidev, rc);
 }

Places

File xsa175-0003-libxl-Do-not-trust-frontend-in-libxl__devices_destro.patch of Package xen.4698

Places