* [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
@ 2016-01-12 12:52 ` Wolfgang Bumiller
0 siblings, 0 replies; 8+ messages in thread
From: Wolfgang Bumiller @ 2016-01-12 12:52 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-trivial, qemu-devel
This pointer should be cleared in vnc_display_close()
otherwise a use-after-free can happen when when using the
old style 'x509' and 'tls' options rather than a persistent
tls-creds -object, by issuing monitor commands to change
the vnc server like so:
Start with: -vnc unix:test.socket,x509,tls
Then use the following monitor command:
change vnc unix:test.socket
After this the pointer is still set but invalid and a crash
can be triggered for instance by issuing the same command a
second time which will try to object_unparent() the same
pointer again.
---
ui/vnc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/ui/vnc.c b/ui/vnc.c
index 09756cd..35843b5 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
vs->subauth = VNC_AUTH_INVALID;
if (vs->tlscreds) {
object_unparent(OBJECT(vs->tlscreds));
+ vs->tlscreds = NULL;
}
g_free(vs->tlsaclname);
vs->tlsaclname = NULL;
--
2.1.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [Qemu-trivial] [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
2016-01-12 12:52 ` [Qemu-devel] " Wolfgang Bumiller
@ 2016-01-12 13:01 ` Daniel P. Berrange
-1 siblings, 0 replies; 8+ messages in thread
From: Daniel P. Berrange @ 2016-01-12 13:01 UTC (permalink / raw)
To: Wolfgang Bumiller; +Cc: qemu-trivial, Gerd Hoffmann, qemu-devel
On Tue, Jan 12, 2016 at 01:52:39PM +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
> ---
> ui/vnc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 09756cd..35843b5 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
> vs->subauth = VNC_AUTH_INVALID;
> if (vs->tlscreds) {
> object_unparent(OBJECT(vs->tlscreds));
> + vs->tlscreds = NULL;
> }
> g_free(vs->tlsaclname);
> vs->tlsaclname = NULL;
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
@ 2016-01-12 13:01 ` Daniel P. Berrange
0 siblings, 0 replies; 8+ messages in thread
From: Daniel P. Berrange @ 2016-01-12 13:01 UTC (permalink / raw)
To: Wolfgang Bumiller; +Cc: qemu-trivial, Gerd Hoffmann, qemu-devel
On Tue, Jan 12, 2016 at 01:52:39PM +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
> ---
> ui/vnc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 09756cd..35843b5 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
> vs->subauth = VNC_AUTH_INVALID;
> if (vs->tlscreds) {
> object_unparent(OBJECT(vs->tlscreds));
> + vs->tlscreds = NULL;
> }
> g_free(vs->tlsaclname);
> vs->tlsaclname = NULL;
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-trivial] [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
2016-01-12 12:52 ` [Qemu-devel] " Wolfgang Bumiller
@ 2016-01-12 14:07 ` Wolfgang Bumiller
-1 siblings, 0 replies; 8+ messages in thread
From: Wolfgang Bumiller @ 2016-01-12 14:07 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-trivial, qemu-devel
Ah I forgot to --signoff, sorry
> On January 12, 2016 at 1:52 PM Wolfgang Bumiller <w.bumiller@proxmox.com> wrote:
>
>
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
> ---
> ui/vnc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 09756cd..35843b5 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
> vs->subauth = VNC_AUTH_INVALID;
> if (vs->tlscreds) {
> object_unparent(OBJECT(vs->tlscreds));
> + vs->tlscreds = NULL;
> }
> g_free(vs->tlsaclname);
> vs->tlsaclname = NULL;
> --
> 2.1.4
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
@ 2016-01-12 14:07 ` Wolfgang Bumiller
0 siblings, 0 replies; 8+ messages in thread
From: Wolfgang Bumiller @ 2016-01-12 14:07 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-trivial, qemu-devel
Ah I forgot to --signoff, sorry
> On January 12, 2016 at 1:52 PM Wolfgang Bumiller <w.bumiller@proxmox.com> wrote:
>
>
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
> ---
> ui/vnc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 09756cd..35843b5 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
> vs->subauth = VNC_AUTH_INVALID;
> if (vs->tlscreds) {
> object_unparent(OBJECT(vs->tlscreds));
> + vs->tlscreds = NULL;
> }
> g_free(vs->tlsaclname);
> vs->tlsaclname = NULL;
> --
> 2.1.4
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-trivial] [PATCH] vnc: clear vs->tlscreds after unparenting it
2016-01-12 12:52 ` [Qemu-devel] " Wolfgang Bumiller
@ 2016-01-12 14:26 ` Gerd Hoffmann
-1 siblings, 0 replies; 8+ messages in thread
From: Gerd Hoffmann @ 2016-01-12 14:26 UTC (permalink / raw)
To: Wolfgang Bumiller; +Cc: qemu-trivial, qemu-devel
On Di, 2016-01-12 at 13:52 +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
Added to patch queue.
thanks,
Gerd
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc: clear vs->tlscreds after unparenting it
@ 2016-01-12 14:26 ` Gerd Hoffmann
0 siblings, 0 replies; 8+ messages in thread
From: Gerd Hoffmann @ 2016-01-12 14:26 UTC (permalink / raw)
To: Wolfgang Bumiller; +Cc: qemu-trivial, qemu-devel
On Di, 2016-01-12 at 13:52 +0100, Wolfgang Bumiller wrote:
> This pointer should be cleared in vnc_display_close()
> otherwise a use-after-free can happen when when using the
> old style 'x509' and 'tls' options rather than a persistent
> tls-creds -object, by issuing monitor commands to change
> the vnc server like so:
>
> Start with: -vnc unix:test.socket,x509,tls
> Then use the following monitor command:
> change vnc unix:test.socket
>
> After this the pointer is still set but invalid and a crash
> can be triggered for instance by issuing the same command a
> second time which will try to object_unparent() the same
> pointer again.
Added to patch queue.
thanks,
Gerd
^ permalink raw reply [flat|nested] 8+ messages in thread