xenbus: reject unterminated directory replies

split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.

Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>

diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index c202e7c553a682fc701142d0d55330be311a402d..d1cca4acb6f33076b7474ea8b4b45f9d168bb766 100644 (file)
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -417,6 +417,12 @@ static char **split_strings(char *strings, unsigned int len, unsigned int *num)
 {
        char *p, **ret;
 
+       if (len && strings[len - 1]) {
+               pr_err_once("malformed XS_DIRECTORY reply\n");
+               kfree(strings);
+               return ERR_PTR(-EIO);
+       }
+
        /* Count the strings. */
        *num = count_strings(strings, len);