[BUG] libxl: `xl shutdown ""` powers off the host

[msd-xenproject.org@xxxxxx]

Hi,

An empty domain qualifier seems silently resolved to domain 0, 
so a command such as :

    xl shutdown ""

does not fail with an error: it shuts down dom0, which powers off the
whole host.

Impact
------

We ran `xl shutdown ""` on a Debian host running Xen 4.20. 
Instead of printing an "invalid domain identifier" error, xl asked dom0 to shut 
down, and the
physical server powered off, taking every guest down with it.

The same input is easy to produce by accident, for example from a shell
script with an unset variable:

    xl shutdown "$VM"     # VM is empty or unset

The diagnostic and patch is proposed assisted by Anthropic Claude. 
I haven't tested it, it was generated when I was trying to understand if the 
shutdown behavior is normal.
I just hope it will help you understanding faster.


Cause (Anthropic Claude)
------------------------

In tools/libs/light/libxl_utils.c:

    int libxl_domain_qualifier_to_domid(libxl_ctx *ctx, const char *name,
                                        uint32_t *domid)
    {
        int i, rv;
        for (i=0; name[i]; i++) {
            if (!CTYPE(isdigit, name[i])) {
                goto nondigit_found;
            }
        }
        *domid = strtoul(name, NULL, 10);
        return 0;
        ...

With name == "", the loop body never runs, so the string is treated as
"all digits". strtoul("", NULL, 10) returns 0 without any error
detection, and the function returns success with *domid == 0.
find_domain() in tools/xl/xl_utils.c then sees rc == 0 and carries on
with domid 0.

Every xl subcommand that resolves its argument through find_domain()
(destroy, reboot, pause, ...) is affected in the same way.


Proposed fix (Anthropic Claude)
-------------------------------

Reject the empty string up front, using the same error code as
libxl_name_to_domid() already uses for an unknown name.

--- a/tools/libs/light/libxl_utils.c
+++ b/tools/libs/light/libxl_utils.c
@@ -92,6 +92,10 @@ int libxl_domain_qualifier_to_domid(libxl_ctx *ctx, const 
char *name,
                                     uint32_t *domid)
 {
     int i, rv;
+
+    if (!name[0])
+        return ERROR_INVAL;
+
     for (i=0; name[i]; i++) {
         if (!CTYPE(isdigit, name[i])) {
             goto nondigit_found;

With this, `xl shutdown ""` prints:

    "" is an invalid domain identifier (rc=<ERROR_INVAL>)

and exits with EXIT_FAILURE, without touching dom0.

(The line numbers in the hunk header are approximate; We have not built
or tested the patch.)


--

What do you think about it ?

Regards,

Msd