[xen master] tools/xenstore: fix get_spec_node()

[patchbot@xxxxxxx]

commit cef523b4a7ca34ba6cfd368d41b180fd640801bc
Author:     Juergen Gross <jgross@xxxxxxxx>
AuthorDate: Thu Jul 27 09:48:58 2023 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Jul 27 09:48:58 2023 +0200

    tools/xenstore: fix get_spec_node()
    
    In case get_spec_node() is being called for a special node starting
    with '@' it won't set *canonical_name. This can result in a crash of
    xenstored due to dereferencing the uninitialized name in
    fire_watches().
    
    This is no security issue as it requires either a privileged caller or
    ownership of the special node in question by an unprivileged caller
    (which is questionable, as this would make the owner privileged in some
    way).
    
    Fixes: d6bb63924fc2 ("tools/xenstore: introduce dummy nodes for special 
watch paths")
    Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
    Reviewed-by: Julien Grall <jgrall@xxxxxxxxxx>
---
 tools/xenstore/xenstored_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index 6d27b2dd7f..9f1328a31f 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1253,8 +1253,11 @@ static struct node *get_spec_node(struct connection 
*conn, const void *ctx,
                                  const char *name, const char **canonical_name,
                                  unsigned int perm)
 {
-       if (name[0] == '@')
+       if (name[0] == '@') {
+               if (canonical_name)
+                       *canonical_name = name;
                return get_node(conn, ctx, name, perm);
+       }
 
        return get_node_canonicalized(conn, ctx, name, canonical_name, perm);
 }
--
generated by git-patchbot for /home/xen/git/xen.git#master