Re: [BUG] libxl: `xl shutdown ""` powers off the host

[Jan Beulich <jbeulich@xxxxxxxx>]

On 15.10.2026 13:54, msd-xenproject.org@xxxxxx wrote:
> Hi,
> 
> An empty domain qualifier seems silently resolved to domain 0, 
> so a command such as :
> 
>     xl shutdown ""
> 
> does not fail with an error: it shuts down dom0, which powers off the
> whole host.
> 
> Impact
> ------
> 
> We ran `xl shutdown ""` on a Debian host running Xen 4.20. 
> Instead of printing an "invalid domain identifier" error, xl asked dom0 to 
> shut down, and the
> physical server powered off, taking every guest down with it.
> 
> The same input is easy to produce by accident, for example from a shell
> script with an unset variable:
> 
>     xl shutdown "$VM"     # VM is empty or unset

I agree this isn't good behavior.

> The diagnostic and patch is proposed assisted by Anthropic Claude. 
> I haven't tested it, it was generated when I was trying to understand if the 
> shutdown behavior is normal.
> I just hope it will help you understanding faster.
> 
> 
> Cause (Anthropic Claude)
> ------------------------
> 
> In tools/libs/light/libxl_utils.c:
> 
>     int libxl_domain_qualifier_to_domid(libxl_ctx *ctx, const char *name,
>                                         uint32_t *domid)
>     {
>         int i, rv;
>         for (i=0; name[i]; i++) {
>             if (!CTYPE(isdigit, name[i])) {
>                 goto nondigit_found;
>             }
>         }
>         *domid = strtoul(name, NULL, 10);
>         return 0;
>         ...
> 
> With name == "", the loop body never runs, so the string is treated as
> "all digits". strtoul("", NULL, 10) returns 0 without any error
> detection, and the function returns success with *domid == 0.
> find_domain() in tools/xl/xl_utils.c then sees rc == 0 and carries on
> with domid 0.
> 
> Every xl subcommand that resolves its argument through find_domain()
> (destroy, reboot, pause, ...) is affected in the same way.
> 
> 
> Proposed fix (Anthropic Claude)
> -------------------------------
> 
> Reject the empty string up front, using the same error code as
> libxl_name_to_domid() already uses for an unknown name.
> 
> --- a/tools/libs/light/libxl_utils.c
> +++ b/tools/libs/light/libxl_utils.c
> @@ -92,6 +92,10 @@ int libxl_domain_qualifier_to_domid(libxl_ctx *ctx, const 
> char *name,
>                                      uint32_t *domid)
>  {
>      int i, rv;
> +
> +    if (!name[0])
> +        return ERROR_INVAL;
> +
>      for (i=0; name[i]; i++) {
>          if (!CTYPE(isdigit, name[i])) {
>              goto nondigit_found;

Instead of returning a error, this case may better be wired to also invoke
libxl_name_to_domid(). Unless of course it is well-defined that domain names
must be of non-zero length.

I'd also suggest to go further and delete the loop. Why would we re-do what
strtoul() is going to do anyway? All we need to do is pass non-NULL as its
middle argument, and then look at what we get back.

Care to submit an actual patch?

Jan