mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Julien Grall
3382512b9f
The function domain_entry_fix() will be initially called to check if the quota is correct before attempt to commit any nodes. So it would be possible that accounting is temporarily negative. This is the case in the following sequence: 1) Create 50 nodes 2) Start two transactions 3) Delete all the nodes in each transaction 4) Commit the two transactions Because the first transaction will have succeed and updated the accounting, there is no guarantee that 'd->nbentry + num' will still be above 0. So the assert() would be triggered. The assert() was introduced indbef1f7482("tools/xenstore: simplify and fix per domain node accounting") with the assumption that the value can't be negative. As this is not true revert to the original check but restricted to the path where we don't update. Take the opportunity to explain the rationale behind the check. This CVE-2023-34323 / XSA-440. Fixes:dbef1f7482("tools/xenstore: simplify and fix per domain node accounting") Signed-off-by: Julien Grall <jgrall@amazon.com> Reviewed-by: Juergen Gross <jgross@suse.com> (cherry picked from commitc4e05c97f5)
The following files are imported from the Samba project. We use the versions from Samba 3, the current stable branch. talloc.c: samba-trunk/source/lib/talloc.c r14291 2006-03-13 04:27:47 +0000 talloc.h: samba-trunk/source/include/talloc.h r11986 2005-12-01 00:43:36 +0000