[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/4] migration: fix use-after-free in loadvm_postcopy
From: |
Amit Shah |
Subject: |
[Qemu-devel] [PULL 2/4] migration: fix use-after-free in loadvm_postcopy_handle_run_bh |
Date: |
Fri, 11 Mar 2016 18:02:12 +0530 |
From: "Denis V. Lunev" <address@hidden>
MigrationState is destroyed before we can come into bottom half.
Signed-off-by: Denis V. Lunev <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
CC: Juan Quintela <address@hidden>
CC: Amit Shah <address@hidden>
CC: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Amit Shah <address@hidden>
---
migration/savevm.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/migration/savevm.c b/migration/savevm.c
index 96e7db5..384e872 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1501,10 +1501,15 @@ static int
loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
return 0;
}
+
+typedef struct {
+ QEMUBH *bh;
+} HandleRunBhData;
+
static void loadvm_postcopy_handle_run_bh(void *opaque)
{
Error *local_err = NULL;
- MigrationIncomingState *mis = opaque;
+ HandleRunBhData *data = opaque;
/* TODO we should move all of this lot into postcopy_ram.c or a shared code
* in migration.c
@@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
runstate_set(RUN_STATE_PAUSED);
}
- qemu_bh_delete(mis->bh);
+ qemu_bh_delete(data->bh);
+ g_free(data);
}
/* After all discards we can start running and asking for pages */
static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
{
PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
+ HandleRunBhData *data;
trace_loadvm_postcopy_handle_run();
if (ps != POSTCOPY_INCOMING_LISTENING) {
@@ -1546,8 +1553,9 @@ static int
loadvm_postcopy_handle_run(MigrationIncomingState *mis)
return -1;
}
- mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL);
- qemu_bh_schedule(mis->bh);
+ data = g_new(HandleRunBhData, 1);
+ data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
+ qemu_bh_schedule(data->bh);
/* We need to finish reading the stream from the package
* and also stop reading anything more from the stream that loaded the
--
2.5.0