[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 03/20] migration: fix the memory overwriting risk in add_to_iovec
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 03/20] migration: fix the memory overwriting risk in add_to_iovec |
Date: |
Thu, 1 Jul 2021 15:15:28 +0100 |
From: Feng Lin <linfeng23@huawei.com>
When testing migration, a Segmentation fault qemu core is generated.
0 error_free (err=0x1)
1 0x00007f8b862df647 in qemu_fclose (f=f@entry=0x55e06c247640)
2 0x00007f8b8516d59a in migrate_fd_cleanup (s=s@entry=0x55e06c0e1ef0)
3 0x00007f8b8516d66c in migrate_fd_cleanup_bh (opaque=0x55e06c0e1ef0)
4 0x00007f8b8626a47f in aio_bh_poll (ctx=ctx@entry=0x55e06b5a16d0)
5 0x00007f8b8626e71f in aio_dispatch (ctx=0x55e06b5a16d0)
6 0x00007f8b8626a33d in aio_ctx_dispatch (source=<optimized out>,
callback=<optimized out>, user_data=<optimized out>)
7 0x00007f8b866bdba4 in g_main_context_dispatch ()
8 0x00007f8b8626cde9 in glib_pollfds_poll ()
9 0x00007f8b8626ce62 in os_host_main_loop_wait (timeout=<optimized out>)
10 0x00007f8b8626cffd in main_loop_wait (nonblocking=nonblocking@entry=0)
11 0x00007f8b862ef01f in main_loop ()
Using gdb print the struct QEMUFile f = {
...,
iovcnt = 65, last_error = 21984,
last_error_obj = 0x1, shutdown = true
}
Well iovcnt is overflow, because the max size of MAX_IOV_SIZE is 64.
struct QEMUFile {
...;
struct iovec iov[MAX_IOV_SIZE];
unsigned int iovcnt;
int last_error;
Error *last_error_obj;
bool shutdown;
};
iovcnt and last_error is overwrited by add_to_iovec().
Right now, add_to_iovec() increase iovcnt before check the limit.
And it seems that add_to_iovec() assumes that iovcnt will set to zero
in qemu_fflush(). But qemu_fflush() will directly return when f->shutdown
is true.
The situation may occur when libvirtd restart during migration, after
f->shutdown is set, before calling qemu_file_set_error() in
qemu_file_shutdown().
So the safiest way is checking the iovcnt before increasing it.
Signed-off-by: Feng Lin <linfeng23@huawei.com>
Message-Id: <20210625062138.1899-1-linfeng23@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Fix typo in 'writeable' which is actually misnamed 'writable'
---
migration/qemu-file.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index d6e03dbc0e..1eacf9e831 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -416,6 +416,11 @@ static int add_to_iovec(QEMUFile *f, const uint8_t *buf,
size_t size,
{
f->iov[f->iovcnt - 1].iov_len += size;
} else {
+ if (f->iovcnt >= MAX_IOV_SIZE) {
+ /* Should only happen if a previous fflush failed */
+ assert(f->shutdown || !qemu_file_is_writable(f));
+ return 1;
+ }
if (may_free) {
set_bit(f->iovcnt, f->may_free);
}
--
2.31.1
- [PULL 00/20] migration queue, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 01/20] tests: migration-test: Still run the rest even if uffd missing, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 02/20] tests: migration-test: Add dirty ring test, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 03/20] migration: fix the memory overwriting risk in add_to_iovec,
Dr. David Alan Gilbert (git) <=
- [PULL 04/20] migration: Move yank outside qemu_start_incoming_migration(), Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 05/20] migration: Allow reset of postcopy_recover_triggered when failed, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 06/20] migration: move wait-unplug loop to its own function, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 07/20] migration: failover: continue to wait card unplug on error, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 08/20] virtiofsd: use GDateTime for formatting timestamp for debug messages, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 09/20] docs: describe the security considerations with virtiofsd xattr mapping, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 10/20] virtiofsd: Don't allow file creation with FUSE_OPEN, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 11/20] virtiofsd: Fix fuse setxattr() API change issue, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 12/20] virtiofsd: Fix xattr operations overwriting errno, Dr. David Alan Gilbert (git), 2021/07/01
- [PULL 13/20] virtiofsd: Add support for extended setxattr, Dr. David Alan Gilbert (git), 2021/07/01