[Qemu-devel] [PATCH 0/2] Fix use after free with mux

[Marc-André Lureau]

Hi,

When qemu with muxed monitor quits, it leads to invalid use after free:

valgrind qemu -chardev stdio,mux=on,id=char0 -mon 
chardev=char0,mode=control,default

    ==4306== Invalid read of size 8
    ==4306==    at 0x8061D3: json_lexer_destroy (json-lexer.c:385)
    ==4306==    by 0x7E39F8: json_message_parser_destroy (json-streamer.c:134)
    ==4306==    by 0x3447F6: monitor_qmp_event (monitor.c:3908)
    ==4306==    by 0x480153: mux_chr_send_event (qemu-char.c:630)
    ==4306==    by 0x480694: mux_chr_event (qemu-char.c:734)
    ==4306==    by 0x47F1E9: qemu_chr_be_event (qemu-char.c:205)
    ==4306==    by 0x481207: fd_chr_close (qemu-char.c:1114)
    ==4306==    by 0x481659: qemu_chr_close_stdio (qemu-char.c:1221)
    ==4306==    by 0x486F07: qemu_chr_free (qemu-char.c:4146)
    ==4306==    by 0x486F97: qemu_chr_delete (qemu-char.c:4154)
    ==4306==    by 0x487E66: qemu_chr_cleanup (qemu-char.c:4678)
    ==4306==    by 0x495A98: main (vl.c:4675)
    ==4306==  Address 0x28439e90 is 112 bytes inside a block of size 240 free'd
    ==4306==    at 0x4C2CD5A: free (vg_replace_malloc.c:530)
    ==4306==    by 0x1E4CBF2D: g_free (in /usr/lib64/libglib-2.0.so.0.4800.2)
    ==4306==    by 0x344DE9: monitor_cleanup (monitor.c:4058)
    ==4306==    by 0x495A93: main (vl.c:4674)
    ==4306==  Block was alloc'd at
    ==4306==    at 0x4C2BBAD: malloc (vg_replace_malloc.c:299)
    ==4306==    by 0x1E4CBE18: g_malloc (in /usr/lib64/libglib-2.0.so.0.4800.2)
    ==4306==    by 0x344BF8: monitor_init (monitor.c:4021)
    ==4306==    by 0x49063C: mon_init_func (vl.c:2417)
    ==4306==    by 0x7FC6DE: qemu_opts_foreach (qemu-option.c:1116)
    ==4306==    by 0x4954E0: main (vl.c:4473)
...

The following two patches fix this by unregistering the muxed chr handlers.

Marc-André Lureau (2):
  char: update read handler in all cases
  char: use a fixed idx for child muxed chr

 qemu-char.c           | 24 ++++++++++++++++--------
 include/sysemu/char.h |  1 +
 2 files changed, 17 insertions(+), 8 deletions(-)

-- 
2.10.0