mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
Juergen Gross
93cc305d1f
Commit562a1c0f7e("tools/xenstore: dont unlink connection object twice") introduced a potential use after free problem in domain_cleanup(): after calling talloc_unlink() for domain->conn domain->conn is set to NULL. The problem is that domain is registered as talloc child of domain->conn, so it might be freed by the talloc_unlink() call. With Xenstore being single threaded there are normally no concurrent memory allocations running and freeing a virtual memory area normally doesn't result in that area no longer being accessible. A problem could occur only in case either a signal received results in some memory allocation done in the signal handler (SIGHUP is a primary candidate leading to reopening the log file), or in case the talloc framework would do some internal memory allocation during freeing of the memory (which would lead to clobbering of the freed domain structure). Fixes:562a1c0f7e("tools/xenstore: dont unlink connection object twice") Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Julien Grall <jgrall@amazon.com> (cherry picked from commitbb2a34fd74) (cherry picked from commitdc5176d0f9) (cherry picked from commita997ffe678) (cherry picked from commit48e8564435) (cherry picked from commit1e722e6971)
The following files are imported from the Samba project. We use the versions from Samba 3, the current stable branch. talloc.c: samba-trunk/source/lib/talloc.c r14291 2006-03-13 04:27:47 +0000 talloc.h: samba-trunk/source/include/talloc.h r11986 2005-12-01 00:43:36 +0000