[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in
From: |
Juan Quintela |
Subject: |
Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() |
Date: |
Tue, 09 Apr 2019 17:46:42 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) |
Peter Maydell <address@hidden> wrote:
> Coverity points out (CID 1400442) that in this code:
>
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> multifd_pages_init(packet->pages_alloc);
> }
>
> we free p->pages in multifd_pages_clear() but continue to
> use it in the following code. We also leak memory, because
> multifd_pages_init() returns the pointer to a new MultiFDPages_t
> struct but we are ignoring its return value.
>
> Fix both of these bugs by adding the missing assignment of
> the newly created struct to p->pages.
>
> Signed-off-by: Peter Maydell <address@hidden>
> ---
ouch,
good catch.
Reviewed-by: Juan Quintela <address@hidden>
> I don't know anything about the multifd code, but this seems like
> the obvious fix based on looking at what the clear and init
> functions are doing. I have only run 'make check' on this,
> so review and testing definitely in order. I think we should
> really put this into 4.0, which means ideally I'd like to
> commit it to master today or tomorrow, though...
> ---
> migration/ram.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/ram.c b/migration/ram.c
> index f68beeeeffc..1ca9ba77b6a 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams
> *p, Error **errp)
> */
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> - multifd_pages_init(packet->pages_alloc);
> + p->pages = multifd_pages_init(packet->pages_alloc);
> }
>
> p->pages->used = be32_to_cpu(packet->pages_used);