From 2c5f7fd78ba894c6a2fd3bfc2d164cc792db8f42 Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Thu, 12 Feb 2026 08:29:38 +0100 Subject: [PATCH] tools/xenstored: fix canonicalize() error testing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The setting of errno in canonicalize() is rather fragile and seems to be even wrong in one corner case: when the invalid path "/local/domain/" is passed, sscanf() will set errno to 0, resulting in canonicalize() to return NULL with errno being 0. This can result in triggering the assert(conn->in == NULL) in consider_message(). Don't assume the initial setting of errno to "EINVAL" will stay valid in all cases and set it to EINVAL only when returning NULL due to an invalid path. This is XSA-481/CVE-2026-23555 Reported-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Reviewed-by: Julien Grall (cherry picked from commit 4c61822b04aac089d1df9ab15ae3a3f6dfb4e305) --- tools/xenstored/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/xenstored/core.c b/tools/xenstored/core.c index dfe98e7bfc..e8a0e3830b 100644 --- a/tools/xenstored/core.c +++ b/tools/xenstored/core.c @@ -1262,11 +1262,10 @@ const char *canonicalize(struct connection *conn, const void *ctx, * - illegal character in node * - starts with '@' but no special node allowed */ - errno = EINVAL; if (!node || !valid_chars(node) || (node[0] == '@' && !allow_special)) - return NULL; + goto inval; if (node[0] != '/' && node[0] != '@') { name = talloc_asprintf(ctx, "%s/%s", get_implicit_path(conn), @@ -1294,6 +1293,8 @@ const char *canonicalize(struct connection *conn, const void *ctx, if (name != node) talloc_free(name); + inval: + errno = EINVAL; return NULL; }