mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Andrii Sultanov
6714207b39
oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. Both need keeping in sync, and right now the global trie is not emptied when a xenbus reconnect is requested. This is basically the same bug as XSA-330, commit491a077ed4("tools/ocaml/xenstored: delete watch from trie too when resetting watches"), just tickled via another path. Arrange for both Process.do_reset_watches() and Process.do_reconnect() to share a common codepath for the resetting of watches and transactions. Notably, this means that the latter now calls Connections.del_watches() which clears the global trie too. Connections.del_watches() already calls Connection.del_watches() so remove the re-clearing of the state from Connection.do_reconnect(). Move History.trim() into reset_watches_and_transactions() so it's on the common path, and place it after removing the transactions rather than before. This is part of XSA-512 / CVE-2026-79604. Reported-by: David Korczynski <David@Adalogics.com> Fixes:674ad2be40("xenstore: extend the xenstore ring with a 'closing' signal") Signed-off-by: Andrii Sultanov <andriy.sultanov@vates.tech> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Andrii Sultanov <andriy.sultanov@vates.tech> (cherry picked from commita2ca4f8b98)