Re: [PATCH] test-vmstate: fix bad GTree usage, use-after-free

[Auger Eric]

Hi Marc-André,

On 8/27/20 8:35 PM, Marc-André Lureau wrote:
> Hi
> 
> On Thu, Aug 27, 2020 at 8:34 PM Auger Eric <eric.auger@redhat.com
> <mailto:eric.auger@redhat.com>> wrote:
> 
>     Hi Marc-Andre
> 
>     On 8/27/20 6:18 PM, marcandre.lureau@redhat.com
>     <mailto:marcandre.lureau@redhat.com> wrote:
>     > From: Marc-André Lureau <marcandre.lureau@redhat.com
>     <mailto:marcandre.lureau@redhat.com>>
>     >
>     > According to g_tree_foreach() documentation:
>     > "The tree may not be modified while iterating over it (you can't
>     > add/remove items)."
> 
>     Hum I did not see that.
>     >
>     > Fixes: 9a85e4b8f6 ("migration: Support gtree migration")
>     > Cc: Eric Auger <eric.auger@redhat.com <mailto:eric.auger@redhat.com>>
>     > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com
>     <mailto:marcandre.lureau@redhat.com>>
>     > ---
>     >  tests/test-vmstate.c | 3 +--
>     >  1 file changed, 1 insertion(+), 2 deletions(-)
>     >
>     > diff --git a/tests/test-vmstate.c b/tests/test-vmstate.c
>     > index f7b3868881..31aefa78f0 100644
>     > --- a/tests/test-vmstate.c
>     > +++ b/tests/test-vmstate.c
>     > @@ -1078,7 +1078,6 @@ static gboolean diff_tree(gpointer key,
>     gpointer value, gpointer data)
>     >      struct match_node_data d = {tp->tree2, key, value};
>     > 
>     >      g_tree_foreach(tp->tree2, tp->match_node, &d);
>     > -    g_tree_remove(tp->tree1, key);
>     it does not test the same thing I am afraid. If one of the trees
>     contains more elements than the others this won't be detected.
> 
> 
> -    assert(g_tree_nnodes(tree1) == 0);
> 
> Was simply checking that all nodes from tree1 were deleted.
> 
> Whatever else must have been checked elsewhere or differently by new code.
compare_trees() iterates on tree1 and tries to find a fellow node in
tree2 for each node in tree1. At least we need to check that the number
of nodes is the same in both trees otherwise tree2 can have more nodes
than tree1 and with the change this won't be detected.
>  
> 
>     Also there is another case of removal inside the traversal in the
>     match_node(): in match_interval_mapping_node() and match_domain_node()
> 
> 
> Yes, but they don't update the traversed tree.
Hum yes, you mean we exit the loop by returning true in the match
function so that's OK.

So your modif + replacing
    g_tree_foreach(tree1, diff_tree, &tp);
    assert(g_tree_nnodes(tree1) == 0);
    assert(g_tree_nnodes(tree2) == 0);

by

assert(g_tree_nnodes(tree1) == g_tree_nnodes(tree2));
g_tree_foreach(tree1, diff_tree, &tp);

should do the job, no?

Thanks

Eric


> 
>     Thanks
> 
>     Eric
> 
> 
>     >      return false;
>     >  }
>     > 
>     > @@ -1088,7 +1087,7 @@ static void compare_trees(GTree *tree1,
>     GTree *tree2,
>     >      struct tree_cmp_data tp = {tree1, tree2, function};
>     > 
>     >      g_tree_foreach(tree1, diff_tree, &tp);
>     > -    assert(g_tree_nnodes(tree1) == 0);> +   
>     g_tree_destroy(g_tree_ref(tree1));
>     >      assert(g_tree_nnodes(tree2) == 0);
>     >  }
>     > 
>     >
> 
> 
> 
> 
> -- 
> Marc-André Lureau