tools/xenstore: don't use conn->in as context for temporary allocations
authorJuergen Gross <jgross@suse.com>
Tue, 13 Sep 2022 05:35:10 +0000 (07:35 +0200)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 1 Nov 2022 14:07:24 +0000 (14:07 +0000)
commitc758765e464e166b5495c76466facc79584bbe1e
tree7dcded1b722d930b4a7e785124154b65195dafdc
parenta026fddf89420dd25c5a9574d88aeab7c5711f6c
tools/xenstore: don't use conn->in as context for temporary allocations

Using the struct buffered data pointer of the current processed request
for temporary data allocations has a major drawback: the used area (and
with that the temporary data) is freed only after the response of the
request has been written to the ring page or has been read via the
socket. This can happen much later in case a guest isn't reading its
responses fast enough.

As the temporary data can be safely freed after creating the response,
add a temporary context for that purpose and use that for allocating
the temporary memory, as it was already the case before commit
cc0612464896 ("xenstore: add small default data buffer to internal
struct").

Some sub-functions need to gain the "const" attribute for the talloc
context.

This is XSA-416 / CVE-2022-42319.

Fixes: cc0612464896 ("xenstore: add small default data buffer to internal struct")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
(cherry picked from commit 2a587de219cc0765330fbf9fac6827bfaf29e29b)
tools/xenstore/xenstored_control.c
tools/xenstore/xenstored_control.h
tools/xenstore/xenstored_core.c
tools/xenstore/xenstored_domain.c
tools/xenstore/xenstored_domain.h
tools/xenstore/xenstored_transaction.c
tools/xenstore/xenstored_transaction.h
tools/xenstore/xenstored_watch.c
tools/xenstore/xenstored_watch.h