diff options
| author | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2017-02-25 22:31:55 +0300 |
|---|---|---|
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2017-02-28 11:30:23 +0000 |
| commit | f9c8caa04f7f2bed12dc5a4d7e92a59fe6677b37 (patch) | |
| tree | 1a783b2de80762744924e7e74e18a2bce393b30b /migration | |
| parent | 5f9412bbac3a6906b2277d6b8aea02bc12a8464d (diff) | |
| download | qemu-f9c8caa04f7f2bed12dc5a4d7e92a59fe6677b37.zip | |
migration: fix use-after-free of to_dst_file
hmp_savevm calls qemu_savevm_state(f), which sets to_dst_file=f in
global migration state. Then hmp_savevm closes f (g_free called).
Next access to to_dst_file in migration state (for example,
qmp_migrate_set_speed) will use it after it was freed.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20170225193155.447462-5-vsementsov@virtuozzo.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Diffstat (limited to 'migration')
| -rw-r--r-- | migration/savevm.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/migration/savevm.c b/migration/savevm.c index 87c7a00832..26d2c44b5e 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -1277,6 +1277,11 @@ done: status = MIGRATION_STATUS_COMPLETED; } migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status); + + /* f is outer parameter, it should not stay in global migration state after + * this function finished */ + ms->to_dst_file = NULL; + return ret; } |