Re: [PATCH v2] util: fix use-after-free in module_load_one

["Philippe Mathieu-Daudé" <philmd@redhat.com>]

On 3/16/21 2:44 PM, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> g_hash_table_add always retains ownership of the pointer passed in as
> the key. Its return status merely indicates whether the added entry was
> new, or replaced an existing entry. Thus key must never be freed after
> this method returns.
> 
> Spotted by ASAN:
> 
> ==2407186==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020003ac4f0 at pc 0x7ffff766659c bp 0x7fffffffd1d0 sp 0x7fffffffc980
> READ of size 1 at 0x6020003ac4f0 thread T0
>     #0 0x7ffff766659b  (/lib64/libasan.so.6+0x8a59b)
>     #1 0x7ffff6bfa843 in g_str_equal ../glib/ghash.c:2303
>     #2 0x7ffff6bf8167 in g_hash_table_lookup_node ../glib/ghash.c:493
>     #3 0x7ffff6bf9b78 in g_hash_table_insert_internal ../glib/ghash.c:1598
>     #4 0x7ffff6bf9c32 in g_hash_table_add ../glib/ghash.c:1689
>     #5 0x5555596caad4 in module_load_one ../util/module.c:233
>     #6 0x5555596ca949 in module_load_one ../util/module.c:225
>     #7 0x5555596ca949 in module_load_one ../util/module.c:225
>     #8 0x5555596cbdf4 in module_load_qom_all ../util/module.c:349
> 
> Typical C bug...
> 
> Fixes: 90629122d2e ("module: use g_hash_table_add()")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  util/module.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>