* [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
@ 2019-04-09 15:18 Peter Maydell
2019-04-09 15:18 ` Peter Maydell
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Peter Maydell @ 2019-04-09 15:18 UTC (permalink / raw)
To: qemu-devel; +Cc: Juan Quintela, Dr. David Alan Gilbert
Coverity points out (CID 1400442) that in this code:
if (packet->pages_alloc > p->pages->allocated) {
multifd_pages_clear(p->pages);
multifd_pages_init(packet->pages_alloc);
}
we free p->pages in multifd_pages_clear() but continue to
use it in the following code. We also leak memory, because
multifd_pages_init() returns the pointer to a new MultiFDPages_t
struct but we are ignoring its return value.
Fix both of these bugs by adding the missing assignment of
the newly created struct to p->pages.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
I don't know anything about the multifd code, but this seems like
the obvious fix based on looking at what the clear and init
functions are doing. I have only run 'make check' on this,
so review and testing definitely in order. I think we should
really put this into 4.0, which means ideally I'd like to
commit it to master today or tomorrow, though...
---
migration/ram.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/migration/ram.c b/migration/ram.c
index f68beeeeffc..1ca9ba77b6a 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
*/
if (packet->pages_alloc > p->pages->allocated) {
multifd_pages_clear(p->pages);
- multifd_pages_init(packet->pages_alloc);
+ p->pages = multifd_pages_init(packet->pages_alloc);
}
p->pages->used = be32_to_cpu(packet->pages_used);
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 15:18 [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() Peter Maydell
@ 2019-04-09 15:18 ` Peter Maydell
2019-04-09 15:46 ` Juan Quintela
2019-04-09 18:49 ` Philippe Mathieu-Daudé
2 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2019-04-09 15:18 UTC (permalink / raw)
To: qemu-devel; +Cc: Dr. David Alan Gilbert, Juan Quintela
Coverity points out (CID 1400442) that in this code:
if (packet->pages_alloc > p->pages->allocated) {
multifd_pages_clear(p->pages);
multifd_pages_init(packet->pages_alloc);
}
we free p->pages in multifd_pages_clear() but continue to
use it in the following code. We also leak memory, because
multifd_pages_init() returns the pointer to a new MultiFDPages_t
struct but we are ignoring its return value.
Fix both of these bugs by adding the missing assignment of
the newly created struct to p->pages.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
I don't know anything about the multifd code, but this seems like
the obvious fix based on looking at what the clear and init
functions are doing. I have only run 'make check' on this,
so review and testing definitely in order. I think we should
really put this into 4.0, which means ideally I'd like to
commit it to master today or tomorrow, though...
---
migration/ram.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/migration/ram.c b/migration/ram.c
index f68beeeeffc..1ca9ba77b6a 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
*/
if (packet->pages_alloc > p->pages->allocated) {
multifd_pages_clear(p->pages);
- multifd_pages_init(packet->pages_alloc);
+ p->pages = multifd_pages_init(packet->pages_alloc);
}
p->pages->used = be32_to_cpu(packet->pages_used);
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 15:18 [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() Peter Maydell
2019-04-09 15:18 ` Peter Maydell
@ 2019-04-09 15:46 ` Juan Quintela
2019-04-09 15:46 ` Juan Quintela
2019-04-09 19:47 ` Peter Maydell
2019-04-09 18:49 ` Philippe Mathieu-Daudé
2 siblings, 2 replies; 8+ messages in thread
From: Juan Quintela @ 2019-04-09 15:46 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel, Dr. David Alan Gilbert
Peter Maydell <peter.maydell@linaro.org> wrote:
> Coverity points out (CID 1400442) that in this code:
>
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> multifd_pages_init(packet->pages_alloc);
> }
>
> we free p->pages in multifd_pages_clear() but continue to
> use it in the following code. We also leak memory, because
> multifd_pages_init() returns the pointer to a new MultiFDPages_t
> struct but we are ignoring its return value.
>
> Fix both of these bugs by adding the missing assignment of
> the newly created struct to p->pages.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
ouch,
good catch.
Reviewed-by: Juan Quintela <quintela@redhat.com>
> I don't know anything about the multifd code, but this seems like
> the obvious fix based on looking at what the clear and init
> functions are doing. I have only run 'make check' on this,
> so review and testing definitely in order. I think we should
> really put this into 4.0, which means ideally I'd like to
> commit it to master today or tomorrow, though...
> ---
> migration/ram.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/ram.c b/migration/ram.c
> index f68beeeeffc..1ca9ba77b6a 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
> */
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> - multifd_pages_init(packet->pages_alloc);
> + p->pages = multifd_pages_init(packet->pages_alloc);
> }
>
> p->pages->used = be32_to_cpu(packet->pages_used);
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 15:46 ` Juan Quintela
@ 2019-04-09 15:46 ` Juan Quintela
2019-04-09 19:47 ` Peter Maydell
1 sibling, 0 replies; 8+ messages in thread
From: Juan Quintela @ 2019-04-09 15:46 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel, Dr. David Alan Gilbert
Peter Maydell <peter.maydell@linaro.org> wrote:
> Coverity points out (CID 1400442) that in this code:
>
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> multifd_pages_init(packet->pages_alloc);
> }
>
> we free p->pages in multifd_pages_clear() but continue to
> use it in the following code. We also leak memory, because
> multifd_pages_init() returns the pointer to a new MultiFDPages_t
> struct but we are ignoring its return value.
>
> Fix both of these bugs by adding the missing assignment of
> the newly created struct to p->pages.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
ouch,
good catch.
Reviewed-by: Juan Quintela <quintela@redhat.com>
> I don't know anything about the multifd code, but this seems like
> the obvious fix based on looking at what the clear and init
> functions are doing. I have only run 'make check' on this,
> so review and testing definitely in order. I think we should
> really put this into 4.0, which means ideally I'd like to
> commit it to master today or tomorrow, though...
> ---
> migration/ram.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/ram.c b/migration/ram.c
> index f68beeeeffc..1ca9ba77b6a 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
> */
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> - multifd_pages_init(packet->pages_alloc);
> + p->pages = multifd_pages_init(packet->pages_alloc);
> }
>
> p->pages->used = be32_to_cpu(packet->pages_used);
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 15:18 [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() Peter Maydell
2019-04-09 15:18 ` Peter Maydell
2019-04-09 15:46 ` Juan Quintela
@ 2019-04-09 18:49 ` Philippe Mathieu-Daudé
2019-04-09 18:49 ` Philippe Mathieu-Daudé
2 siblings, 1 reply; 8+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-04-09 18:49 UTC (permalink / raw)
To: Peter Maydell, qemu-devel; +Cc: Dr. David Alan Gilbert, Juan Quintela
On 4/9/19 5:18 PM, Peter Maydell wrote:
> Coverity points out (CID 1400442) that in this code:
>
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> multifd_pages_init(packet->pages_alloc);
> }
>
> we free p->pages in multifd_pages_clear() but continue to
> use it in the following code. We also leak memory, because
> multifd_pages_init() returns the pointer to a new MultiFDPages_t
> struct but we are ignoring its return value.
>
> Fix both of these bugs by adding the missing assignment of
> the newly created struct to p->pages.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> I don't know anything about the multifd code, but this seems like
> the obvious fix based on looking at what the clear and init
> functions are doing. I have only run 'make check' on this,
> so review and testing definitely in order. I think we should
> really put this into 4.0, which means ideally I'd like to
> commit it to master today or tomorrow, though...
> ---
> migration/ram.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/ram.c b/migration/ram.c
> index f68beeeeffc..1ca9ba77b6a 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
> */
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> - multifd_pages_init(packet->pages_alloc);
> + p->pages = multifd_pages_init(packet->pages_alloc);
> }
>
> p->pages->used = be32_to_cpu(packet->pages_used);
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 18:49 ` Philippe Mathieu-Daudé
@ 2019-04-09 18:49 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 8+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-04-09 18:49 UTC (permalink / raw)
To: Peter Maydell, qemu-devel; +Cc: Dr. David Alan Gilbert, Juan Quintela
On 4/9/19 5:18 PM, Peter Maydell wrote:
> Coverity points out (CID 1400442) that in this code:
>
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> multifd_pages_init(packet->pages_alloc);
> }
>
> we free p->pages in multifd_pages_clear() but continue to
> use it in the following code. We also leak memory, because
> multifd_pages_init() returns the pointer to a new MultiFDPages_t
> struct but we are ignoring its return value.
>
> Fix both of these bugs by adding the missing assignment of
> the newly created struct to p->pages.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> I don't know anything about the multifd code, but this seems like
> the obvious fix based on looking at what the clear and init
> functions are doing. I have only run 'make check' on this,
> so review and testing definitely in order. I think we should
> really put this into 4.0, which means ideally I'd like to
> commit it to master today or tomorrow, though...
> ---
> migration/ram.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/ram.c b/migration/ram.c
> index f68beeeeffc..1ca9ba77b6a 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
> */
> if (packet->pages_alloc > p->pages->allocated) {
> multifd_pages_clear(p->pages);
> - multifd_pages_init(packet->pages_alloc);
> + p->pages = multifd_pages_init(packet->pages_alloc);
> }
>
> p->pages->used = be32_to_cpu(packet->pages_used);
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 15:46 ` Juan Quintela
2019-04-09 15:46 ` Juan Quintela
@ 2019-04-09 19:47 ` Peter Maydell
2019-04-09 19:47 ` Peter Maydell
1 sibling, 1 reply; 8+ messages in thread
From: Peter Maydell @ 2019-04-09 19:47 UTC (permalink / raw)
To: Juan Quintela; +Cc: QEMU Developers, Dr. David Alan Gilbert
On Tue, 9 Apr 2019 at 22:42, Juan Quintela <quintela@redhat.com> wrote:
>
> Peter Maydell <peter.maydell@linaro.org> wrote:
> > Coverity points out (CID 1400442) that in this code:
> >
> > if (packet->pages_alloc > p->pages->allocated) {
> > multifd_pages_clear(p->pages);
> > multifd_pages_init(packet->pages_alloc);
> > }
> >
> > we free p->pages in multifd_pages_clear() but continue to
> > use it in the following code. We also leak memory, because
> > multifd_pages_init() returns the pointer to a new MultiFDPages_t
> > struct but we are ignoring its return value.
> >
> > Fix both of these bugs by adding the missing assignment of
> > the newly created struct to p->pages.
> >
> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> > ---
>
> ouch,
>
> good catch.
>
> Reviewed-by: Juan Quintela <quintela@redhat.com>
Thanks for the quick review. Applied to master for rc3.
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
2019-04-09 19:47 ` Peter Maydell
@ 2019-04-09 19:47 ` Peter Maydell
0 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2019-04-09 19:47 UTC (permalink / raw)
To: Juan Quintela; +Cc: QEMU Developers, Dr. David Alan Gilbert
On Tue, 9 Apr 2019 at 22:42, Juan Quintela <quintela@redhat.com> wrote:
>
> Peter Maydell <peter.maydell@linaro.org> wrote:
> > Coverity points out (CID 1400442) that in this code:
> >
> > if (packet->pages_alloc > p->pages->allocated) {
> > multifd_pages_clear(p->pages);
> > multifd_pages_init(packet->pages_alloc);
> > }
> >
> > we free p->pages in multifd_pages_clear() but continue to
> > use it in the following code. We also leak memory, because
> > multifd_pages_init() returns the pointer to a new MultiFDPages_t
> > struct but we are ignoring its return value.
> >
> > Fix both of these bugs by adding the missing assignment of
> > the newly created struct to p->pages.
> >
> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> > ---
>
> ouch,
>
> good catch.
>
> Reviewed-by: Juan Quintela <quintela@redhat.com>
Thanks for the quick review. Applied to master for rc3.
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-04-09 19:48 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-04-09 15:18 [Qemu-devel] [PATCH for-4.0] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() Peter Maydell
2019-04-09 15:18 ` Peter Maydell
2019-04-09 15:46 ` Juan Quintela
2019-04-09 15:46 ` Juan Quintela
2019-04-09 19:47 ` Peter Maydell
2019-04-09 19:47 ` Peter Maydell
2019-04-09 18:49 ` Philippe Mathieu-Daudé
2019-04-09 18:49 ` Philippe Mathieu-Daudé
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).