[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_postcop
From: |
Denis V. Lunev |
Subject: |
[Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_postcopy_handle_run_bh |
Date: |
Wed, 9 Mar 2016 18:35:08 +0300 |
MigrationState is destroyed before we can come into bottom half.
Signed-off-by: Denis V. Lunev <address@hidden>
CC: Juan Quintela <address@hidden>
CC: Amit Shah <address@hidden>
CC: Dr. David Alan Gilbert <address@hidden>
---
Dave, do you have tests you have mention available on public? I'd better
run them in advance next time.
migration/savevm.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/migration/savevm.c b/migration/savevm.c
index 96e7db5..384e872 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1501,10 +1501,15 @@ static int
loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
return 0;
}
+
+typedef struct {
+ QEMUBH *bh;
+} HandleRunBhData;
+
static void loadvm_postcopy_handle_run_bh(void *opaque)
{
Error *local_err = NULL;
- MigrationIncomingState *mis = opaque;
+ HandleRunBhData *data = opaque;
/* TODO we should move all of this lot into postcopy_ram.c or a shared code
* in migration.c
@@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
runstate_set(RUN_STATE_PAUSED);
}
- qemu_bh_delete(mis->bh);
+ qemu_bh_delete(data->bh);
+ g_free(data);
}
/* After all discards we can start running and asking for pages */
static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
{
PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
+ HandleRunBhData *data;
trace_loadvm_postcopy_handle_run();
if (ps != POSTCOPY_INCOMING_LISTENING) {
@@ -1546,8 +1553,9 @@ static int
loadvm_postcopy_handle_run(MigrationIncomingState *mis)
return -1;
}
- mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL);
- qemu_bh_schedule(mis->bh);
+ data = g_new(HandleRunBhData, 1);
+ data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
+ qemu_bh_schedule(data->bh);
/* We need to finish reading the stream from the package
* and also stop reading anything more from the stream that loaded the
--
2.1.4
- [Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_postcopy_handle_run_bh,
Denis V. Lunev <=