Re: [PATCH] char: fix use-after-free with dup chardev & reconnect

[Daniel P . Berrangé]

On Mon, Apr 20, 2020 at 01:20:12PM +0200, Marc-André Lureau wrote:
> With a reconnect socket, qemu_char_open() will start a background
> thread. It should keep a reference on the chardev.
> 
> Fixes invalid read:
> READ of size 8 at 0x6040000ac858 thread T7
>     #0 0x5555598d37b8 in unix_connect_saddr 
> /home/elmarco/src/qq/util/qemu-sockets.c:954
>     #1 0x5555598d4751 in socket_connect 
> /home/elmarco/src/qq/util/qemu-sockets.c:1109
>     #2 0x555559707c34 in qio_channel_socket_connect_sync 
> /home/elmarco/src/qq/io/channel-socket.c:145
>     #3 0x5555596adebb in tcp_chr_connect_client_task 
> /home/elmarco/src/qq/chardev/char-socket.c:1104
>     #4 0x555559723d55 in qio_task_thread_worker 
> /home/elmarco/src/qq/io/task.c:123
>     #5 0x5555598a6731 in qemu_thread_start 
> /home/elmarco/src/qq/util/qemu-thread-posix.c:519
>     #6 0x7ffff40d4431 in start_thread (/lib64/libpthread.so.0+0x9431)
>     #7 0x7ffff40029d2 in __clone (/lib64/libc.so.6+0x1019d2)
> 
> Signed-off-by: Marc-André Lureau <address@hidden>
> ---
>  chardev/char-socket.c |  3 ++-
>  tests/test-char.c     | 51 ++++++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 52 insertions(+), 2 deletions(-)


Reviewed-by: Daniel P. Berrangé <address@hidden>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|