|
From: | Juan Quintela |
Subject: | Re: [PATCH v4] test-vmstate: fix bad GTree usage, use-after-free |
Date: | Tue, 28 Feb 2023 11:41:12 +0100 |
User-agent: | Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
Eric Auger <eric.auger@redhat.com> wrote: > According to g_tree_foreach() documentation: > "The tree may not be modified while iterating over it (you can't > add/remove items)." > > compare_trees()/diff_tree() fail to respect this rule. > Historically GLib2 used a slice allocator for the GTree APIs > which did not immediately release the memory back to the system > allocator. As a result QEMU's use-after-free bug was not visible. > With GLib > 2.75.3 however, GLib2 has switched to using malloc > and now a SIGSEGV can be observed while running test-vmstate. > > Get rid of the node removal within the tree traversal. Also > check the trees have the same number of nodes before the actual > diff. > > Fixes: 9a85e4b8f6 ("migration: Support gtree migration") > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518 > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > Signed-off-by: Eric Auger <eric.auger@redhat.com> > Reported-by: Richard W.M. Jones <rjones@redhat.com> > Tested-by: Richard W.M. Jones <rjones@redhat.com> > Reviewed-by: Richard W.M. Jones <rjones@redhat.com> > Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> queued.
[Prev in Thread] | Current Thread | [Next in Thread] |