openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

migration: fix use-after-free in loadvm_postcopy_handle_run_bh 

MigrationState is destroyed before we can come into bottom half.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Amit Shah <amit.shah@redhat.com>
CC: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <1457537708-8622-1-git-send-email-den@openvz.org>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
This commit is contained in:
Denis V. Lunev 2016-03-09 18:35:08 +03:00 committed by Amit Shah
parent 568b01caf3
commit 8646992279
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
migration/savevm.c
View File

@ -1501,10 +1501,15 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
return 0; return 0;
} }
typedef struct {
QEMUBH *bh;
} HandleRunBhData;
static void loadvm_postcopy_handle_run_bh(void *opaque) static void loadvm_postcopy_handle_run_bh(void *opaque)
{ {
Error *local_err = NULL; Error *local_err = NULL;
MigrationIncomingState *mis = opaque; HandleRunBhData *data = opaque;
/* TODO we should move all of this lot into postcopy_ram.c or a shared code /* TODO we should move all of this lot into postcopy_ram.c or a shared code
* in migration.c * in migration.c
@ -1532,13 +1537,15 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
runstate_set(RUN_STATE_PAUSED); runstate_set(RUN_STATE_PAUSED);
} }
qemu_bh_delete(mis->bh); qemu_bh_delete(data->bh);
g_free(data);
} }
/* After all discards we can start running and asking for pages */ /* After all discards we can start running and asking for pages */
static int loadvm_postcopy_handle_run(MigrationIncomingState *mis) static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
{ {
PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING); PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
HandleRunBhData *data;
trace_loadvm_postcopy_handle_run(); trace_loadvm_postcopy_handle_run();
if (ps != POSTCOPY_INCOMING_LISTENING) { if (ps != POSTCOPY_INCOMING_LISTENING) {
@ -1546,8 +1553,9 @@ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
return -1; return -1;
} }
mis->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, NULL); data = g_new(HandleRunBhData, 1);
qemu_bh_schedule(mis->bh); data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
qemu_bh_schedule(data->bh);
/* We need to finish reading the stream from the package /* We need to finish reading the stream from the package
* and also stop reading anything more from the stream that loaded the * and also stop reading anything more from the stream that loaded the