All of lore.kernel.org
 help / color / mirror / Atom feed
From: Gerd Hoffmann <kraxel@redhat.com>
To: Wolfgang Bumiller <w.bumiller@proxmox.com>
Cc: qemu-trivial@nongnu.org, qemu-devel@nongnu.org
Subject: Re: [Qemu-trivial] [PATCH] vnc: clear vs->tlscreds after unparenting it
Date: Tue, 12 Jan 2016 15:26:42 +0100	[thread overview]
Message-ID: <1452608802.29014.27.camel@redhat.com> (raw)
In-Reply-To: <1452603159-19782-1-git-send-email-w.bumiller@proxmox.com>

On Di, 2016-01-12 at 13:52 +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
> 
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
>   change vnc unix:test.socket
> 
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.

Added to patch queue.

thanks,
  Gerd



WARNING: multiple messages have this Message-ID (diff)
From: Gerd Hoffmann <kraxel@redhat.com>
To: Wolfgang Bumiller <w.bumiller@proxmox.com>
Cc: qemu-trivial@nongnu.org, qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
Date: Tue, 12 Jan 2016 15:26:42 +0100	[thread overview]
Message-ID: <1452608802.29014.27.camel@redhat.com> (raw)
In-Reply-To: <1452603159-19782-1-git-send-email-w.bumiller@proxmox.com>

On Di, 2016-01-12 at 13:52 +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
> 
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
>   change vnc unix:test.socket
> 
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.

Added to patch queue.

thanks,
  Gerd

  parent reply	other threads:[~2016-01-12 14:26 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-12 12:52 [Qemu-trivial] [PATCH] vnc: clear vs->tlscreds after unparenting it Wolfgang Bumiller
2016-01-12 12:52 ` [Qemu-devel] " Wolfgang Bumiller
2016-01-12 13:01 ` [Qemu-trivial] " Daniel P. Berrange
2016-01-12 13:01   ` Daniel P. Berrange
2016-01-12 14:07 ` [Qemu-trivial] " Wolfgang Bumiller
2016-01-12 14:07   ` Wolfgang Bumiller
2016-01-12 14:26 ` Gerd Hoffmann [this message]
2016-01-12 14:26   ` Gerd Hoffmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1452608802.29014.27.camel@redhat.com \
    --to=kraxel@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-trivial@nongnu.org \
    --cc=w.bumiller@proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.