From 864699227911909ef1e33ecf91bf3c900715a9b1 Mon Sep 17 00:00:00 2001 From: "Denis V. Lunev" Date: Wed, 9 Mar 2016 18:35:08 +0300 Subject: migration: fix use-after-free in loadvm_postcopy_handle_run_bh MigrationState is destroyed before we can come into bottom half. Signed-off-by: Denis V. Lunev Reviewed-by: Dr. David Alan Gilbert CC: Juan Quintela CC: Amit Shah CC: Dr. David Alan Gilbert Message-Id: <1457537708-8622-1-git-send-email-den@openvz.org> Signed-off-by: Amit Shah --- migration/savevm.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'migration') diff --git a/migration/savevm.c b/migration/savevm.c index 96e7db5967..384e8727ef 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -1501,10 +1501,15 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis) return 0; } + +typedef struct { + QEMUBH *bh; +} HandleRunBhData; + static void loadvm_postcopy_handle_run_bh(void *opaque) { Error *local_err = NULL; - MigrationIncomingState *mis = opaque; + HandleRunBhData *data = opaque; /* TODO we should move all of this lot into postcopy_ram.c or a shared code * in migration.c @@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque) runstate_set(RUN_STATE_PAUSED); } - qemu_bh_delete(mis->bh); + qemu_bh_delete(data->bh); + g_free(data); } /* After all discards we can start running and asking for pages */ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis) { PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING); + HandleRunBhData *data; trace_loadvm_postcopy_handle_run(); if (ps != POSTCOPY_INCOMING_LISTENING) { @@ -1546,8 +1553,9 @@ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis) return -1; } - mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL); - qemu_bh_schedule(mis->bh); + data = g_new(HandleRunBhData, 1); + data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data); + qemu_bh_schedule(data->bh); /* We need to finish reading the stream from the package * and also stop reading anything more from the stream that loaded the -- cgit v1.2.1