mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Kevin Lampis
4c3ce492ed
The livepatch list sysctl writes metadata into a buffer provided by the caller. The caller is expected to allocate an appropriately sized buffer but this is racy and may result in Xen writing beyond the end of the buffer should the metadata size change. The name buffer is expected to be an array of elements with size XEN_LIVEPATCH_NAME_SIZE to avoid this kind of race but the xen-livepatch tool allocates only as many bytes as needed, therefore encountering the same potential race condition. Fix both these issues by requiring the caller to pass in the size of the name and metadata buffers and then not writing beyond the allocated size. The sysctl interface version is bumped due to the change in semantics of the fields. Signed-off-by: Kevin Lampis <kevin.lampis@cloud.com> Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Fixes:b145b4a39c('livepatch: Handle arbitrary size names with the list operation') Fixes:5083e0ff93('livepatch: Add metadata runtime retrieval mechanism') Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>