From patchwork Wed Mar 9 15:35:08 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis V. Lunev" X-Patchwork-Id: 8547171 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C5668C0553 for ; Wed, 9 Mar 2016 15:35:43 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2ADCB20125 for ; Wed, 9 Mar 2016 15:35:43 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5E03820295 for ; Wed, 9 Mar 2016 15:35:41 +0000 (UTC) Received: from localhost ([::1]:42145 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adg9E-0000Xb-Kn for patchwork-qemu-devel@patchwork.kernel.org; Wed, 09 Mar 2016 10:35:40 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56243) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adg91-0000XE-IS for qemu-devel@nongnu.org; Wed, 09 Mar 2016 10:35:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adg8w-0004Ey-Ku for qemu-devel@nongnu.org; Wed, 09 Mar 2016 10:35:27 -0500 Received: from mailhub.sw.ru ([195.214.232.25]:26494 helo=relay.sw.ru) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adg8w-0004AG-7f for qemu-devel@nongnu.org; Wed, 09 Mar 2016 10:35:22 -0500 Received: from irbis.sw.ru ([10.30.2.139]) by relay.sw.ru (8.13.4/8.13.4) with ESMTP id u29FZ8Du006947; Wed, 9 Mar 2016 18:35:10 +0300 (MSK) From: "Denis V. Lunev" To: Date: Wed, 9 Mar 2016 18:35:08 +0300 Message-Id: <1457537708-8622-1-git-send-email-den@openvz.org> X-Mailer: git-send-email 2.1.4 X-detected-operating-system: by eggs.gnu.org: OpenBSD 3.x X-Received-From: 195.214.232.25 Cc: Amit Shah , "Denis V. Lunev" , qemu-devel@nongnu.org, "Dr. David Alan Gilbert" , Juan Quintela Subject: [Qemu-devel] [PATCH 1/1] migration: fix use-after-free in loadvm_postcopy_handle_run_bh X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP MigrationState is destroyed before we can come into bottom half. Signed-off-by: Denis V. Lunev CC: Juan Quintela CC: Amit Shah CC: Dr. David Alan Gilbert Reviewed-by: Dr. David Alan Gilbert --- Dave, do you have tests you have mention available on public? I'd better run them in advance next time. migration/savevm.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/migration/savevm.c b/migration/savevm.c index 96e7db5..384e872 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -1501,10 +1501,15 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis) return 0; } + +typedef struct { + QEMUBH *bh; +} HandleRunBhData; + static void loadvm_postcopy_handle_run_bh(void *opaque) { Error *local_err = NULL; - MigrationIncomingState *mis = opaque; + HandleRunBhData *data = opaque; /* TODO we should move all of this lot into postcopy_ram.c or a shared code * in migration.c @@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque) runstate_set(RUN_STATE_PAUSED); } - qemu_bh_delete(mis->bh); + qemu_bh_delete(data->bh); + g_free(data); } /* After all discards we can start running and asking for pages */ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis) { PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING); + HandleRunBhData *data; trace_loadvm_postcopy_handle_run(); if (ps != POSTCOPY_INCOMING_LISTENING) { @@ -1546,8 +1553,9 @@ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis) return -1; } - mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL); - qemu_bh_schedule(mis->bh); + data = g_new(HandleRunBhData, 1); + data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data); + qemu_bh_schedule(data->bh); /* We need to finish reading the stream from the package * and also stop reading anything more from the stream that loaded the