From patchwork Thu Apr 7 11:04:11 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Samuel Thibault X-Patchwork-Id: 8771101 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 83F829FC82 for ; Thu, 7 Apr 2016 11:04:31 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D62CF2020F for ; Thu, 7 Apr 2016 11:04:30 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 17097201EC for ; Thu, 7 Apr 2016 11:04:30 +0000 (UTC) Received: from localhost ([::1]:48955 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ao7jh-0005QK-HG for patchwork-qemu-devel@patchwork.kernel.org; Thu, 07 Apr 2016 07:04:29 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37598) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ao7jX-0005Pn-Bp for qemu-devel@nongnu.org; Thu, 07 Apr 2016 07:04:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ao7jU-0007cK-VV for qemu-devel@nongnu.org; Thu, 07 Apr 2016 07:04:19 -0400 Received: from mail2-relais-roc.national.inria.fr ([192.134.164.83]:34031) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ao7jU-0007c8-PU for qemu-devel@nongnu.org; Thu, 07 Apr 2016 07:04:16 -0400 X-IronPort-AV: E=Sophos;i="5.24,449,1454972400"; d="scan'208";a="212711753" Received: from unknown (HELO var.youpi.perso.aquilenet.fr) ([193.50.110.219]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/AES128-GCM-SHA256; 07 Apr 2016 13:04:14 +0200 Received: from samy by var.youpi.perso.aquilenet.fr with local (Exim 4.87) (envelope-from ) id 1ao7jS-0005Wu-6i; Thu, 07 Apr 2016 13:04:14 +0200 From: Samuel Thibault To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Thu, 7 Apr 2016 13:04:11 +0200 Message-Id: <1460027053-21211-3-git-send-email-samuel.thibault@ens-lyon.org> X-Mailer: git-send-email 2.8.0.rc3 In-Reply-To: <1460027053-21211-1-git-send-email-samuel.thibault@ens-lyon.org> References: <1460027053-21211-1-git-send-email-samuel.thibault@ens-lyon.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 192.134.164.83 Cc: steven@steven676.net, jan.kiszka@siemens.com, Steven Luo , Samuel Thibault , edgar.iglesias@gmail.com Subject: [Qemu-devel] [PULL 2/4] slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Steven Luo Samuel Thibault pointed out that it's possible that slirp_pollfds_poll() will try to use a socket even after soread() returns an error, resulting in an use-after-free if the socket was removed while handling the error. Avoid this by refusing to continue to work with the socket in this case. Signed-off-by: Steven Luo Signed-off-by: Samuel Thibault --- slirp/slirp.c | 12 +++++++++++- slirp/socket.c | 17 +++++++++++------ slirp/socket.h | 2 +- 3 files changed, 23 insertions(+), 8 deletions(-) diff --git a/slirp/slirp.c b/slirp/slirp.c index fef526c..9f4bea3 100644 --- a/slirp/slirp.c +++ b/slirp/slirp.c @@ -534,7 +534,12 @@ void slirp_pollfds_poll(GArray *pollfds, int select_error) * test for G_IO_IN below if this succeeds */ if (revents & G_IO_PRI) { - sorecvoob(so); + ret = sorecvoob(so); + if (ret < 0) { + /* Socket error might have resulted in the socket being + * removed, do not try to do anything more with it. */ + continue; + } } /* * Check sockets for reading @@ -553,6 +558,11 @@ void slirp_pollfds_poll(GArray *pollfds, int select_error) if (ret > 0) { tcp_output(sototcpcb(so)); } + if (ret < 0) { + /* Socket error might have resulted in the socket being + * removed, do not try to do anything more with it. */ + continue; + } } /* diff --git a/slirp/socket.c b/slirp/socket.c index b836c42..7f022a6 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -260,10 +260,11 @@ err: * so when OOB data arrives, we soread() it and everything * in the send buffer is sent as urgent data */ -void +int sorecvoob(struct socket *so) { struct tcpcb *tp = sototcpcb(so); + int ret; DEBUG_CALL("sorecvoob"); DEBUG_ARG("so = %p", so); @@ -276,11 +277,15 @@ sorecvoob(struct socket *so) * urgent data, or the read() doesn't return all the * urgent data. */ - soread(so); - tp->snd_up = tp->snd_una + so->so_snd.sb_cc; - tp->t_force = 1; - tcp_output(tp); - tp->t_force = 0; + ret = soread(so); + if (ret > 0) { + tp->snd_up = tp->snd_una + so->so_snd.sb_cc; + tp->t_force = 1; + tcp_output(tp); + tp->t_force = 0; + } + + return ret; } /* diff --git a/slirp/socket.h b/slirp/socket.h index e9c9b05..7dca506 100644 --- a/slirp/socket.h +++ b/slirp/socket.h @@ -127,7 +127,7 @@ struct socket *solookup(struct socket **, struct socket *, struct socket *socreate(Slirp *); void sofree(struct socket *); int soread(struct socket *); -void sorecvoob(struct socket *); +int sorecvoob(struct socket *); int sosendoob(struct socket *); int sowrite(struct socket *); void sorecvfrom(struct socket *);