[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen staging-4.14] tools/xenstore: remove recursion from construct_node()
commit 4d2fe1d32c3bb6e966522840e2080377db9e9f65 Author: Juergen Gross <jgross@xxxxxxxx> AuthorDate: Tue Sep 13 07:35:11 2022 +0200 Commit: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> CommitDate: Tue Nov 1 15:20:41 2022 +0000 tools/xenstore: remove recursion from construct_node() In order to reduce stack usage due to recursion, switch construct_node() to use a loop instead. This is part of XSA-418 / CVE-2022-42321. Signed-off-by: Juergen Gross <jgross@xxxxxxxx> Reviewed-by: Julien Grall <jgrall@xxxxxxxxxx> (cherry picked from commit da8ee25d02a5447ba39a9800ee2a710ae1f54222) --- tools/xenstore/xenstored_core.c | 110 ++++++++++++++++++++++++++-------------- 1 file changed, 72 insertions(+), 38 deletions(-) diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c index 34a8469dd6..e7971c828e 100644 --- a/tools/xenstore/xenstored_core.c +++ b/tools/xenstore/xenstored_core.c @@ -1254,57 +1254,91 @@ static char *basename(const char *name) return strrchr(name, '/') + 1; } -static struct node *construct_node(struct connection *conn, const void *ctx, - const char *name) +static int add_child(const void *ctx, struct node *parent, const char *name) { const char *base; unsigned int baselen; - struct node *parent, *node; - char *children, *parentname = get_parent(ctx, name); - - if (!parentname) - return NULL; + char *children; - /* If parent doesn't exist, create it. */ - parent = read_node(conn, parentname, parentname); - if (!parent && errno == ENOENT) - parent = construct_node(conn, ctx, parentname); - if (!parent) - return NULL; - - /* Add child to parent. */ base = basename(name); baselen = strlen(base) + 1; children = talloc_array(ctx, char, parent->childlen + baselen); if (!children) - goto nomem; + return ENOMEM; memcpy(children, parent->children, parent->childlen); memcpy(children + parent->childlen, base, baselen); parent->children = children; parent->childlen += baselen; - /* Allocate node */ - node = talloc(ctx, struct node); - if (!node) - goto nomem; - node->name = talloc_strdup(node, name); - if (!node->name) - goto nomem; - - /* Inherit permissions, except unprivileged domains own what they create */ - node->perms.num = parent->perms.num; - node->perms.p = talloc_memdup(node, parent->perms.p, - node->perms.num * sizeof(*node->perms.p)); - if (!node->perms.p) - goto nomem; - if (domain_is_unprivileged(conn)) - node->perms.p[0].id = conn->id; - - /* No children, no data */ - node->children = node->data = NULL; - node->childlen = node->datalen = 0; - node->acc.memory = 0; - node->parent = parent; + return 0; +} + +static struct node *construct_node(struct connection *conn, const void *ctx, + const char *name) +{ + const char **names = NULL; + unsigned int levels = 0; + struct node *node = NULL; + struct node *parent = NULL; + const char *parentname = talloc_strdup(ctx, name); + + if (!parentname) + return NULL; + + /* Walk the path up until an existing node is found. */ + while (!parent) { + names = talloc_realloc(ctx, names, const char *, levels + 1); + if (!names) + goto nomem; + + /* + * names[0] is the name of the node to construct initially, + * names[1] is its parent, and so on. + */ + names[levels] = parentname; + parentname = get_parent(ctx, parentname); + if (!parentname) + return NULL; + + /* Try to read parent node until we found an existing one. */ + parent = read_node(conn, ctx, parentname); + if (!parent && (errno != ENOENT || !strcmp(parentname, "/"))) + return NULL; + + levels++; + } + + /* Walk the path down again constructing the missing nodes. */ + for (; levels > 0; levels--) { + /* Add child to parent. */ + if (add_child(ctx, parent, names[levels - 1])) + goto nomem; + + /* Allocate node */ + node = talloc(ctx, struct node); + if (!node) + goto nomem; + node->name = talloc_steal(node, names[levels - 1]); + + /* Inherit permissions, unpriv domains own what they create. */ + node->perms.num = parent->perms.num; + node->perms.p = talloc_memdup(node, parent->perms.p, + node->perms.num * + sizeof(*node->perms.p)); + if (!node->perms.p) + goto nomem; + if (domain_is_unprivileged(conn)) + node->perms.p[0].id = conn->id; + + /* No children, no data */ + node->children = node->data = NULL; + node->childlen = node->datalen = 0; + node->acc.memory = 0; + node->parent = parent; + + parent = node; + } + return node; nomem: -- generated by git-patchbot for /home/xen/git/xen.git#staging-4.14
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |