[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 0/2] Fix use after free with mux
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH 0/2] Fix use after free with mux |
Date: |
Mon, 3 Oct 2016 11:56:58 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 |
On 03/10/2016 11:47, Marc-André Lureau wrote:
> Hi,
>
> When qemu with muxed monitor quits, it leads to invalid use after free:
>
> valgrind qemu -chardev stdio,mux=on,id=char0 -mon
> chardev=char0,mode=control,default
>
> ==4306== Invalid read of size 8
> ==4306== at 0x8061D3: json_lexer_destroy (json-lexer.c:385)
> ==4306== by 0x7E39F8: json_message_parser_destroy (json-streamer.c:134)
> ==4306== by 0x3447F6: monitor_qmp_event (monitor.c:3908)
> ==4306== by 0x480153: mux_chr_send_event (qemu-char.c:630)
> ==4306== by 0x480694: mux_chr_event (qemu-char.c:734)
> ==4306== by 0x47F1E9: qemu_chr_be_event (qemu-char.c:205)
> ==4306== by 0x481207: fd_chr_close (qemu-char.c:1114)
> ==4306== by 0x481659: qemu_chr_close_stdio (qemu-char.c:1221)
> ==4306== by 0x486F07: qemu_chr_free (qemu-char.c:4146)
> ==4306== by 0x486F97: qemu_chr_delete (qemu-char.c:4154)
> ==4306== by 0x487E66: qemu_chr_cleanup (qemu-char.c:4678)
> ==4306== by 0x495A98: main (vl.c:4675)
> ==4306== Address 0x28439e90 is 112 bytes inside a block of size 240
> free'd
> ==4306== at 0x4C2CD5A: free (vg_replace_malloc.c:530)
> ==4306== by 0x1E4CBF2D: g_free (in /usr/lib64/libglib-2.0.so.0.4800.2)
> ==4306== by 0x344DE9: monitor_cleanup (monitor.c:4058)
> ==4306== by 0x495A93: main (vl.c:4674)
> ==4306== Block was alloc'd at
> ==4306== at 0x4C2BBAD: malloc (vg_replace_malloc.c:299)
> ==4306== by 0x1E4CBE18: g_malloc (in
> /usr/lib64/libglib-2.0.so.0.4800.2)
> ==4306== by 0x344BF8: monitor_init (monitor.c:4021)
> ==4306== by 0x49063C: mon_init_func (vl.c:2417)
> ==4306== by 0x7FC6DE: qemu_opts_foreach (qemu-option.c:1116)
> ==4306== by 0x4954E0: main (vl.c:4473)
> ...
>
> The following two patches fix this by unregistering the muxed chr handlers.
If I read the code right, patch 1 without patch 2 can cause the mux_cnt
to overflow the size of the d->chr_* arrays. Ok to invert the order?
Thanks,
Paolo
>
> Marc-André Lureau (2):
> char: update read handler in all cases
> char: use a fixed idx for child muxed chr
>
> qemu-char.c | 24 ++++++++++++++++--------
> include/sysemu/char.h | 1 +
> 2 files changed, 17 insertions(+), 8 deletions(-)
>
Re: [Qemu-devel] [PATCH 0/2] Fix use after free with mux,
Paolo Bonzini <=