mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Julien Grall
149ebf0e02
XSA-115 extended destroy_node() to update the node accounting for the connection. The implementation is assuming the connection is the parent of the node, however all the nodes are allocated using a separate context (see process_message()). This will result to crash (or corrupt) xenstored as the pointer is wrongly used. In case of an error, any changes to the database or update to the accounting will now be reverted in create_node() by calling directly destroy_node(). This has the nice advantage to remove the loop to unset the destructors in case of success. Take the opportunity to free the nodes right now as they are not going to be reachable (the function returns NULL) and are just wasting resources. This is XSA-414 / CVE-2022-42309. Fixes:0bfb2101f2("tools/xenstore: fix node accounting after failed node creation") Signed-off-by: Julien Grall <jgrall@amazon.com> Reviewed-by: Juergen Gross <jgross@suse.com> (cherry picked from commit1cd3cc7ea2)