mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
Edwin Török
c46eff9212
domain ids are prone to wrapping (15-bits), and with sufficient number of VMs in a reboot loop it is possible to trigger it. Xenstore entries may linger after a domain dies, until a toolstack cleans it up. During this time there is a window where a wrapped domid could access these xenstore keys (that belonged to another VM). To prevent this do a cleanup when a domain dies: * walk the entire xenstore tree and update permissions for all nodes * if the dead domain had an ACL entry: remove it * if the dead domain was the owner: change the owner to Dom0 This is done without quota checks or a transaction. Quota checks would be a no-op (either the domain is dead, or it is Dom0 where they are not enforced). Transactions are not needed, because this is all done atomically by oxenstored's single thread. The xenstore entries owned by the dead domain are not deleted, because that could confuse a toolstack / backends that are still bound to it (or generate unexpected watch events). It is the responsibility of a toolstack to remove the xenstore entries themselves. This is part of XSA-322. Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>