[Xen-changelog] [xen stable-4.1] oxenstored: Protect oxenstored from malicious domains.

[patchbot@xxxxxxx]

commit 070ab4c505934951f86f42dd8403cf62bc5822f0
Author:     Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
AuthorDate: Tue Sep 3 11:55:48 2013 +0100
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Tue Sep 3 12:03:39 2013 +0100

    oxenstored: Protect oxenstored from malicious domains.
    
    add check logic when read from IO ring, and if error happens,
    then mark the reading connection as "bad", Unless vm reboot,
    oxenstored will not handle message from this connection any more.
    
    xs_ring_stubs.c: add a more strict check on ring reading
    connection.ml, domain.ml: add getter and setter for bad flag
    process.ml: if exception raised when reading from domain's ring,
                mark this domain as "bad"
    xenstored.ml: if a domain is marked as "bad", do not handle it.
    
    Signed-off-by: John Liu <john.liuqiming@xxxxxxxxxx>
    Acked-by: David Scott <dave.scott@xxxxxxxxxxxxx>
    (cherry picked from commit 704302ce9404c73cfb687d31adcf67094ab5bb53)
    (cherry picked from commit a978634bee4db6c5e0ceeb66adcc5114f3f9bc48)
    
    Conflicts:
        tools/ocaml/xenstored/domain.ml
    
    Signed-off-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    (cherry picked from commit 9f93027afd796a98d7b92898f4ccc772796a4874)
---
 tools/ocaml/libs/xb/xs_ring_stubs.c |    6 +++++-
 tools/ocaml/xenstored/connection.ml |    5 +++++
 tools/ocaml/xenstored/domain.ml     |    7 ++++++-
 tools/ocaml/xenstored/process.ml    |   12 +++++++++++-
 tools/ocaml/xenstored/xenstored.ml  |    7 ++++---
 5 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/tools/ocaml/libs/xb/xs_ring_stubs.c 
b/tools/ocaml/libs/xb/xs_ring_stubs.c
index 37649df..eddeec3 100644
--- a/tools/ocaml/libs/xb/xs_ring_stubs.c
+++ b/tools/ocaml/libs/xb/xs_ring_stubs.c
@@ -49,6 +49,10 @@ static int xs_ring_read(struct mmap_interface *interface,
        cons = *(volatile uint32*)&intf->req_cons;
        prod = *(volatile uint32*)&intf->req_prod;
        xen_mb();
+
+       if ((prod - cons) > XENSTORE_RING_SIZE)
+           return -1;
+
        if (prod == cons)
                return 0;
        cons = MASK_XENSTORE_IDX(cons);
@@ -98,7 +102,7 @@ CAMLprim value ml_interface_read(value interface, value 
buffer, value len)
        res = xs_ring_read(GET_C_STRUCT(interface),
                           String_val(buffer), Int_val(len));
        if (res == -1)
-               caml_failwith("huh");
+               caml_failwith("bad connection");
        result = Val_int(res);
        CAMLreturn(result);
 }
diff --git a/tools/ocaml/xenstored/connection.ml 
b/tools/ocaml/xenstored/connection.ml
index 70cdbbf..c15595b 100644
--- a/tools/ocaml/xenstored/connection.ml
+++ b/tools/ocaml/xenstored/connection.ml
@@ -38,6 +38,11 @@ and t = {
        mutable perm: Perms.Connection.t;
 }
 
+let mark_as_bad con =
+       match con.dom with
+       |None -> ()
+       | Some domain -> Domain.mark_as_bad domain
+
 let get_path con =
 Printf.sprintf "/local/domain/%i/" (match con.dom with None -> 0 | Some d -> 
Domain.get_id d)
 
diff --git a/tools/ocaml/xenstored/domain.ml b/tools/ocaml/xenstored/domain.ml
index 258d172..b41b00c 100644
--- a/tools/ocaml/xenstored/domain.ml
+++ b/tools/ocaml/xenstored/domain.ml
@@ -26,6 +26,7 @@ type t =
        interface: Mmap.mmap_interface;
        eventchn: Event.t;
        mutable port: int;
+       mutable bad_client: bool;
 }
 
 let get_path dom = "/local/domain/" ^ (sprintf "%u" dom.id)
@@ -34,6 +35,9 @@ let get_interface d = d.interface
 let get_mfn d = d.mfn
 let get_remote_port d = d.remote_port
 
+let is_bad_domain domain = domain.bad_client
+let mark_as_bad domain = domain.bad_client <- true
+
 let dump d chan =
        fprintf chan "dom,%d,%nd,%d\n" d.id d.mfn d.port
 
@@ -56,7 +60,8 @@ let make id mfn remote_port interface eventchn = {
        remote_port = remote_port;
        interface = interface;
        eventchn = eventchn;
-       port = -1
+       port = -1;
+       bad_client = false
 }
 
 let is_dom0 d = d.id = 0
diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
index 1549774..bd87646 100644
--- a/tools/ocaml/xenstored/process.ml
+++ b/tools/ocaml/xenstored/process.ml
@@ -368,7 +368,17 @@ let write_answer_log ~ty ~tid ~con ~data =
        Logging.xb_answer ~ty ~tid ~con:(Connection.get_domstr con) data
 
 let do_input store cons doms con =
-       if Connection.do_input con then (
+       let newpacket =
+               try
+                       Connection.do_input con
+               with Failure exp ->
+                       error "caught exception %s" exp;
+                       error "got a bad client %s" (sprintf "%-8s" 
(Connection.get_domstr con));
+                       Connection.mark_as_bad con;
+                       false
+       in
+
+       if newpacket then (
                let packet = Connection.pop_in con in
                let tid, rid, ty, data = Xb.Packet.unpack packet in
                (* As we don't log IO, do not call an unnecessary sanitize_data 
diff --git a/tools/ocaml/xenstored/xenstored.ml 
b/tools/ocaml/xenstored/xenstored.ml
index 91cde8d..d004ad2 100644
--- a/tools/ocaml/xenstored/xenstored.ml
+++ b/tools/ocaml/xenstored/xenstored.ml
@@ -49,9 +49,10 @@ let process_connection_fds store cons domains rset wset =
 
 let process_domains store cons domains =
        let do_io_domain domain =
-               let con = Connections.find_domain cons (Domain.get_id domain) in
-               Process.do_input store cons domains con;
-               Process.do_output store cons domains con in
+               if not (Domain.is_bad_domain domain) then
+                       let con = Connections.find_domain cons (Domain.get_id 
domain) in
+                               Process.do_input store cons domains con;
+                               Process.do_output store cons domains con in
        Domains.iter domains do_io_domain
 
 let sigusr1_handler store =
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.1

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog