| Message ID | 20210316134456.3243102-1-marcandre.lureau@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] util: fix use-after-free in module_load_one | expand |
On 3/16/21 2:44 PM, marcandre.lureau@redhat.com wrote: > From: Marc-André Lureau <marcandre.lureau@redhat.com> > > g_hash_table_add always retains ownership of the pointer passed in as > the key. Its return status merely indicates whether the added entry was > new, or replaced an existing entry. Thus key must never be freed after > this method returns. > > Spotted by ASAN: > > ==2407186==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020003ac4f0 at pc 0x7ffff766659c bp 0x7fffffffd1d0 sp 0x7fffffffc980 > READ of size 1 at 0x6020003ac4f0 thread T0 > #0 0x7ffff766659b (/lib64/libasan.so.6+0x8a59b) > #1 0x7ffff6bfa843 in g_str_equal ../glib/ghash.c:2303 > #2 0x7ffff6bf8167 in g_hash_table_lookup_node ../glib/ghash.c:493 > #3 0x7ffff6bf9b78 in g_hash_table_insert_internal ../glib/ghash.c:1598 > #4 0x7ffff6bf9c32 in g_hash_table_add ../glib/ghash.c:1689 > #5 0x5555596caad4 in module_load_one ../util/module.c:233 > #6 0x5555596ca949 in module_load_one ../util/module.c:225 > #7 0x5555596ca949 in module_load_one ../util/module.c:225 > #8 0x5555596cbdf4 in module_load_qom_all ../util/module.c:349 > > Typical C bug... > > Fixes: 90629122d2e ("module: use g_hash_table_add()") > Cc: qemu-stable@nongnu.org > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> > --- > util/module.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
diff --git a/util/module.c b/util/module.c index c65060c167..a2ab0bcdbc 100644 --- a/util/module.c +++ b/util/module.c @@ -230,10 +230,11 @@ bool module_load_one(const char *prefix, const char *lib_name, bool mayfail) } } - if (!g_hash_table_add(loaded_modules, module_name)) { + if (g_hash_table_contains(loaded_modules, module_name)) { g_free(module_name); return true; } + g_hash_table_add(loaded_modules, module_name); search_dir = getenv("QEMU_MODULE_DIR"); if (search_dir != NULL) {