Commit 8fe5ab41 authored by Simon Gaiser's avatar Simon Gaiser Committed by Boris Ostrovsky
Browse files

xen: xenbus_dev_frontend: Verify body of XS_TRANSACTION_END 



By guaranteeing that the argument of XS_TRANSACTION_END is valid we can
assume that the transaction has been closed when we get an XS_ERROR
response from xenstore (Note that we already verify that it's a valid
transaction id).

Signed-off-by: default avatarSimon Gaiser <simon@invisiblethingslab.com>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
parent b93008d1

drivers/xen/xenbus/xenbus_dev_frontend.c

+11 −3
Original line number Diff line number Diff line
@@ -429,6 +429,10 @@ static int xenbus_write_transaction(unsigned msg_type, 
{

	int rc;

	struct xenbus_transaction_holder *trans = NULL;

	struct {

		struct xsd_sockmsg hdr;

		char body[];

	} *msg = (void *)u->u.buffer;



	if (msg_type == XS_TRANSACTION_START) {

		trans = kzalloc(sizeof(*trans), GFP_KERNEL);
@@ -437,11 +441,15 @@ static int xenbus_write_transaction(unsigned msg_type, 
			goto out;

		}

		list_add(&trans->list, &u->transactions);

	} else if (u->u.msg.tx_id != 0 &&

		   !xenbus_get_transaction(u, u->u.msg.tx_id))

	} else if (msg->hdr.tx_id != 0 &&

		   !xenbus_get_transaction(u, msg->hdr.tx_id))

		return xenbus_command_reply(u, XS_ERROR, "ENOENT");

	else if (msg_type == XS_TRANSACTION_END &&

		 !(msg->hdr.len == 2 &&

		   (!strcmp(msg->body, "T") || !strcmp(msg->body, "F"))))

		return xenbus_command_reply(u, XS_ERROR, "EINVAL");



	rc = xenbus_dev_request_and_reply(&u->u.msg, u);

	rc = xenbus_dev_request_and_reply(&msg->hdr, u);

	if (rc && trans) {

		list_del(&trans->list);

		kfree(trans);

CRA Git | Maintained and supported by SUSTech CRA and CCSE