1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
From ef216637a72ce30661d28a47ccc7464869baa398 Mon Sep 17 00:00:00 2001
From: Ian Jackson <ian.jackson@eu.citrix.com>
Date: Tue, 3 May 2016 18:39:36 +0100
Subject: [PATCH 03/10] libxl: Do not trust frontend in libxl__devices_destroy
We need to enumerate the devices we have provided to a domain, without
trusting the guest-writeable (or, at least, guest-deletable) frontend
paths.
Instead, enumerate via, and read the backend path from, /libxl.
The console /libxl path is regular, so the special case for console 0
is not relevant any more: /libxl/GUEST/device/console/0 will be found,
and then libxl__device_destroy will DTRT to the right frontend path.
This is part of XSA-175.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
---
tools/libxl/libxl_device.c | 22 +++-------------------
1 file changed, 3 insertions(+), 19 deletions(-)
diff --git a/tools/libxl/libxl_device.c b/tools/libxl/libxl_device.c
index b500264..e7650d0 100644
--- a/tools/libxl/libxl_device.c
+++ b/tools/libxl/libxl_device.c
@@ -665,7 +665,7 @@ void libxl__devices_destroy(libxl__egc *egc, libxl__devices_remove_state *drs)
libxl__multidev_begin(ao, multidev);
multidev->callback = devices_remove_callback;
- path = GCSPRINTF("/local/domain/%d/device", domid);
+ path = GCSPRINTF("/libxl/%d/device", domid);
kinds = libxl__xs_directory(gc, XBT_NULL, path, &num_kinds);
if (!kinds) {
if (errno != ENOENT) {
@@ -678,12 +678,12 @@ void libxl__devices_destroy(libxl__egc *egc, libxl__devices_remove_state *drs)
if (libxl__device_kind_from_string(kinds[i], &kind))
continue;
- path = GCSPRINTF("/local/domain/%d/device/%s", domid, kinds[i]);
+ path = GCSPRINTF("/libxl/%d/device/%s", domid, kinds[i]);
devs = libxl__xs_directory(gc, XBT_NULL, path, &num_dev_xsentries);
if (!devs)
continue;
for (j = 0; j < num_dev_xsentries; j++) {
- path = GCSPRINTF("/local/domain/%d/device/%s/%s/backend",
+ path = GCSPRINTF("/libxl/%d/device/%s/%s/backend",
domid, kinds[i], devs[j]);
path = libxl__xs_read(gc, XBT_NULL, path);
GCNEW(dev);
@@ -708,22 +708,6 @@ void libxl__devices_destroy(libxl__egc *egc, libxl__devices_remove_state *drs)
}
}
- /* console 0 frontend directory is not under /local/domain/<domid>/device */
- path = GCSPRINTF("/local/domain/%d/console/backend", domid);
- path = libxl__xs_read(gc, XBT_NULL, path);
- GCNEW(dev);
- if (path && strcmp(path, "") &&
- libxl__parse_backend_path(gc, path, dev) == 0) {
- dev->domid = domid;
- dev->kind = LIBXL__DEVICE_KIND_CONSOLE;
- dev->devid = 0;
-
- /* Currently console devices can be destroyed synchronously by just
- * removing xenstore entries, this is what libxl__device_destroy does.
- */
- libxl__device_destroy(gc, dev);
- }
-
out:
libxl__multidev_prepared(egc, multidev, rc);
}
--
2.1.4
|
