OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

migration: fix use-after-free in loadvm_postcopy_handle_run_bh

Browse Source 
MigrationState is destroyed before we can come into bottom half.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Amit Shah <amit.shah@redhat.com>
CC: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <1457537708-8622-1-git-send-email-den@openvz.org>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
This commit is contained in:
Denis V. Lunev 2016-03-09 18:35:08 +03:00 committed by Amit Shah
parent 568b01caf3
commit 8646992279
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
migration/savevm.c
View File

@ -1501,10 +1501,15 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
return 0;
}
typedef struct {
QEMUBH *bh;
} HandleRunBhData;
static void loadvm_postcopy_handle_run_bh(void *opaque)
{
Error *local_err = NULL;
MigrationIncomingState *mis = opaque;
HandleRunBhData *data = opaque;
/* TODO we should move all of this lot into postcopy_ram.c or a shared code
* in migration.c
@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
runstate_set(RUN_STATE_PAUSED);
}
qemu_bh_delete(mis->bh);
qemu_bh_delete(data->bh);
g_free(data);
}
/* After all discards we can start running and asking for pages */
static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
{
PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
HandleRunBhData *data;
trace_loadvm_postcopy_handle_run();
if (ps != POSTCOPY_INCOMING_LISTENING) {
@ -1546,8 +1553,9 @@ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
return -1;
}
mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL);
qemu_bh_schedule(mis->bh);
data = g_new(HandleRunBhData, 1);
data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
qemu_bh_schedule(data->bh);
/* We need to finish reading the stream from the package
* and also stop reading anything more from the stream that loaded the