mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-21 22:47:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

xenbus: reject unterminated directory replies

Browse Source 
split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.

Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>
This commit is contained in:
Yousef Alhouseen
2026-06-27 00:37:38 +02:00
committed by Juergen Gross
parent 2299822f3f
commit cbbef43bdc
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/xen/xenbus/xenbus_xs.c
View File

@@ -417,6 +417,12 @@ static char **split_strings(char *strings, unsigned int len, unsigned int *num)
{
char *p, **ret;
if (len && strings[len - 1]) {
pr_err_once("malformed XS_DIRECTORY reply\n");
kfree(strings);
return ERR_PTR(-EIO);
}
/* Count the strings. */
*num = count_strings(strings, len);