mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
Juergen Gross
562a1c0f7e
A connection object of a domain with associated stubdom has two parents: the domain and the stubdom. When cleaning up the list of active domains in domain_cleanup() make sure not to unlink the connection twice from the same domain. This could happen when the domain and its stubdom are being destroyed at the same time leading to the domain loop being entered twice. Additionally don't use talloc_free() in this case as it will remove a random parent link, leading eventually to a memory leak. Use talloc_unlink() instead specifying the context from which the connection object should be removed. This is CVE-2017-14317 / XSA-233. Reported-by: Eric Chanudet <chanudete@ainfosec.com> Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
The following files are imported from the Samba project. We use the versions from Samba 3, the current stable branch. talloc.c: samba-trunk/source/lib/talloc.c r14291 2006-03-13 04:27:47 +0000 talloc.h: samba-trunk/source/include/talloc.h r11986 2005-12-01 00:43:36 +0000