mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

migration: fix use-after-free of to_dst_file

Browse Source 
hmp_savevm calls qemu_savevm_state(f), which sets to_dst_file=f in
global migration state. Then hmp_savevm closes f (g_free called).

Next access to to_dst_file in migration state (for example,
qmp_migrate_set_speed) will use it after it was freed.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20170225193155.447462-5-vsementsov@virtuozzo.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2017-02-25 22:31:55 +03:00 committed by Dr. David Alan Gilbert
parent 5f9412bbac
commit f9c8caa04f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
migration/savevm.c
View File

@ -1277,6 +1277,11 @@ done:
status = MIGRATION_STATUS_COMPLETED; status = MIGRATION_STATUS_COMPLETED;
} }
migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status); migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
/* f is outer parameter, it should not stay in global migration state after
* this function finished */
ms->to_dst_file = NULL;
return ret; return ret;
} }