[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 11/27] migration: fix use-after-free of to_dst_file
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[Qemu-devel] [PULL 11/27] migration: fix use-after-free of to_dst_file |
Date: |
Tue, 28 Feb 2017 12:40:40 +0000 |
From: Vladimir Sementsov-Ogievskiy <address@hidden>
hmp_savevm calls qemu_savevm_state(f), which sets to_dst_file=f in
global migration state. Then hmp_savevm closes f (g_free called).
Next access to to_dst_file in migration state (for example,
qmp_migrate_set_speed) will use it after it was freed.
Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
---
migration/savevm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/migration/savevm.c b/migration/savevm.c
index 87c7a00..26d2c44 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1277,6 +1277,11 @@ done:
status = MIGRATION_STATUS_COMPLETED;
}
migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
+
+ /* f is outer parameter, it should not stay in global migration state after
+ * this function finished */
+ ms->to_dst_file = NULL;
+
return ret;
}
--
2.9.3
- [Qemu-devel] [PULL 02/27] migration/vmstate: renames in (load|save)_state, (continued)
- [Qemu-devel] [PULL 02/27] migration/vmstate: renames in (load|save)_state, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 03/27] migration/vmstate: split up vmstate_base_addr, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 04/27] migration/vmstate: fix array of ptr with nullptrs, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 05/27] tests/test-vmstate.c: test array of ptr with null, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 06/27] tests/test-vmstate.c: test array of ptr to primitive, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 07/27] vmstate-static-checker: update white list with spapr_pci, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 08/27] migrate: Introduce a 'dc->vmsd' check to avoid segfault for --only-migratable, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 09/27] migration: fix id leak regression, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 10/27] migration: Update docs to discourage version bumps, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 12/27] postcopy: Transmit ram size summary word, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 11/27] migration: fix use-after-free of to_dst_file,
Dr. David Alan Gilbert (git) <=
- [Qemu-devel] [PULL 13/27] postcopy: Transmit and compare individual page sizes, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 14/27] postcopy: Chunk discards for hugepages, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 16/27] postcopy: enhance ram_block_discard_range for hugepages, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 17/27] postcopy: Record largest page size, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 15/27] exec: ram_block_discard_range, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 18/27] postcopy: Plumb pagesize down into place helpers, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 19/27] postcopy: Use temporary for placing zero huge pages, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 20/27] postcopy: Load huge pages in one go, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 21/27] postcopy: Mask fault addresses to huge page boundary, Dr. David Alan Gilbert (git), 2017/02/28
- [Qemu-devel] [PULL 22/27] postcopy: Send whole huge pages, Dr. David Alan Gilbert (git), 2017/02/28