[xen stable-4.22] oxenstored: Reset the watches trie on domain reconnect

[patchbot@xxxxxxx]

commit 1a36aac500bbc20853d0b3b85bc11e8dd91f6af5
Author:     Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
AuthorDate: Thu Aug 20 15:00:02 2026 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Aug 26 17:48:17 2026 +0100

    oxenstored: Reset the watches trie on domain reconnect
    
    oxenstored maintains two datastructures about watches; one global trie, and
    one hashtable tracked per domain.  Both need keeping in sync, and right now
    the global trie is not emptied when a xenbus reconnect is requested.
    
    This is basically the same bug as XSA-330, commit 491a077ed4c5
    ("tools/ocaml/xenstored: delete watch from trie too when resetting 
watches"),
    just tickled via another path.
    
    Arrange for both Process.do_reset_watches() and Process.do_reconnect() to
    share a common codepath for the resetting of watches and transactions.
    Notably, this means that the latter now calls Connections.del_watches() 
which
    clears the global trie too.
    
    Connections.del_watches() already calls Connection.del_watches() so remove 
the
    re-clearing of the state from Connection.do_reconnect().
    
    Move History.trim() into reset_watches_and_transactions() so it's on the
    common path, and place it after removing the transactions rather than 
before.
    
    This is part of XSA-512 / CVE-2026-79604.
    
    Reported-by: David Korczynski <David@xxxxxxxxxxxxx>
    Fixes: 674ad2be409d ("xenstore: extend the xenstore ring with a 'closing' 
signal")
    Signed-off-by: Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
    (cherry picked from commit a2ca4f8b9890899ca89d6116002e7a9c5957d8c6)
---
 tools/ocaml/xenstored/connection.ml |  4 +---
 tools/ocaml/xenstored/process.ml    | 11 +++++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/tools/ocaml/xenstored/connection.ml 
b/tools/ocaml/xenstored/connection.ml
index d11011e164..37eb2444b9 100644
--- a/tools/ocaml/xenstored/connection.ml
+++ b/tools/ocaml/xenstored/connection.ml
@@ -148,13 +148,11 @@ let mark_as_bad con =
 let initial_next_tid = 1
 
 let do_reconnect con =
+  (* transactions and watches handled by caller *)
   Xenbus.Xb.reconnect con.xb;
   (* dom is the same *)
-  Hashtbl.clear con.transactions;
   con.next_tid <- initial_next_tid;
-  Hashtbl.clear con.watches;
   (* anonid is the same *)
-  con.nb_watches <- 0;
   con.stat_nb_ops <- 0;
   (* perm is the same *)
   ()
diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
index bc68c54c9a..fc2558ac3d 100644
--- a/tools/ocaml/xenstored/process.ml
+++ b/tools/ocaml/xenstored/process.ml
@@ -345,15 +345,18 @@ let do_isintroduced con _t domains _cons data =
   in
   if domid = Define.domid_self || Domains.exist domains domid then "T\000" 
else "F\000"
 
-(* only in xen >= 4.2 *)
-let do_reset_watches con _t _domains cons _data =
+let reset_watches_and_transactions cons con =
   Connections.del_watches cons con;
-  Connection.del_transactions con
+  Connection.del_transactions con;
+  History.trim ()
+
+let do_reset_watches con _t _domains cons _data =
+  reset_watches_and_transactions cons con
 
 let do_reconnect cons con =
   let domstr = Connection.get_domstr con in
   info "%s requests a reconnect" domstr;
-  History.trim ();
+  reset_watches_and_transactions cons con;
   Connection.do_reconnect con;
   info "%s reconnection complete" domstr
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.22