Yousef Alhouseen cbbef43bdc xenbus: reject unterminated directory replies ...

split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.

Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>

2026-07-01 10:01:14 +02:00

..

events

treewide: Explicitly include the x86 CPUID headers

2026-05-06 14:29:59 +02:00

xen-pciback

PCI: use generic driver_override infrastructure

2026-04-04 00:44:30 +02:00

xenbus

xenbus: reject unterminated directory replies

2026-07-01 10:01:14 +02:00

xenfs

…

acpi.c

…

arm-device.c

…

balloon.c

…

biomerge.c

…

cpu_hotplug.c

…

dbgp.c

…

efi.c

…

evtchn.c

…

features.c

…

gntalloc.c

xen/gntalloc: validate grant count before allocation

2026-07-01 09:58:24 +02:00

gntdev-common.h

…

gntdev-dmabuf.c

…

gntdev-dmabuf.h

…

gntdev.c

xen/gntdev: fix error handling in ioctl

2026-07-01 09:51:09 +02:00

grant-dma-iommu.c

…

grant-dma-ops.c

of: Factor arguments passed to of_map_id() into a struct

2026-06-12 10:25:39 -05:00

grant-table.c

treewide: Explicitly include the x86 CPUID headers

2026-05-06 14:29:59 +02:00

Kconfig

…

Makefile

…

manage.c

xen/manage: unwind partial shutdown watcher setup on error

2026-04-10 11:04:02 +02:00

mcelog.c

xen/mcelog: mark g_physinfo, ncpus and xen_mce_chrdev_device as __ro_after_init

2026-06-08 09:01:02 +02:00

mem-reservation.c

…

pci.c

…

pcpu.c

…

platform-pci.c

xen/platform-pci: Simplify initialization of pci_device_id array

2026-06-08 08:57:25 +02:00

privcmd-buf.c

…

privcmd.c

xen/privcmd: fix double free via VMA splitting

2026-04-23 15:32:59 +02:00

privcmd.h

…

pvcalls-back.c

…

pvcalls-front.c

xen/pvcalls: bound backend response req_id before indexing rsp[]

2026-07-01 09:31:02 +02:00

pvcalls-front.h

…

swiotlb-xen.c

Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

2026-04-17 11:12:42 -07:00

sys-hypervisor.c

Buffer overflow in drivers/xen/sys-hypervisor.c

2026-04-23 15:32:51 +02:00

time.c

…

unpopulated-alloc.c

…

xen-acpi-pad.c

ACPI: PAD: xen: Check ACPI_COMPANION() against NULL

2026-05-12 19:01:37 +02:00

xen-acpi-processor.c

…

xen-balloon.c

xen: balloon: Replace sprintf() with sysfs_emit()

2026-06-08 09:01:49 +02:00

xen-front-pgdir-shbuf.c

xen/front-pgdir-shbuf: free grant reference head on errors

2026-07-01 09:51:41 +02:00

xen-scsiback.c

…

xlate_mmu.c

…