Re: [PATCH v4] test-vmstate: fix bad GTree usage, use-after-free

[Juan Quintela]

Eric Auger <eric.auger@redhat.com> wrote:
> According to g_tree_foreach() documentation:
> "The tree may not be modified while iterating over it (you can't
> add/remove items)."
>
> compare_trees()/diff_tree() fail to respect this rule.
> Historically GLib2 used a slice allocator for the GTree APIs
> which did not immediately release the memory back to the system
> allocator. As a result QEMU's use-after-free bug was not visible.
> With GLib > 2.75.3 however, GLib2 has switched to using malloc
> and now a SIGSEGV can be observed while running test-vmstate.
>
> Get rid of the node removal within the tree traversal. Also
> check the trees have the same number of nodes before the actual
> diff.
>
> Fixes: 9a85e4b8f6 ("migration: Support gtree migration")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> Signed-off-by: Eric Auger <eric.auger@redhat.com>
> Reported-by: Richard W.M. Jones <rjones@redhat.com>
> Tested-by: Richard W.M. Jones <rjones@redhat.com>
> Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

Reviewed-by: Juan Quintela <quintela@redhat.com>

queued.