openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

io: remove io watch if TLS channel is closed during handshake 

The TLS handshake make take some time to complete, during which time an
I/O watch might be registered with the main loop. If the owner of the
I/O channel invokes qio_channel_close() while the handshake is waiting
to continue the I/O watch must be removed. Failing to remove it will
later trigger the completion callback which the owner is not expecting
to receive. In the case of the VNC server, this results in a SEGV as
vnc_disconnect_start() tries to shutdown a client connection that is
already gone / NULL.

CVE-2023-3354
Reported-by: jiangyegen <jiangyegen@huawei.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: zeng_chi <zengchi@kylinos.cn>
This commit is contained in:
Daniel P. Berrangé 2023-06-20 09:45:34 +01:00 committed by zengchi
parent f8400015f4
commit b722a90334
2 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/io/channel-tls.h
View File

@ -48,6 +48,7 @@ struct QIOChannelTLS {
QIOChannel *master; QIOChannel *master;
QCryptoTLSSession *session; QCryptoTLSSession *session;
QIOChannelShutdown shutdown; QIOChannelShutdown shutdown;
guint hs_ioc_tag;
}; };
/** /**

18
io/channel-tls.c
View File

@ -195,12 +195,13 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
} }
trace_qio_channel_tls_handshake_pending(ioc, status); trace_qio_channel_tls_handshake_pending(ioc, status);
qio_channel_add_watch_full(ioc->master, ioc->hs_ioc_tag =
condition, qio_channel_add_watch_full(ioc->master,
qio_channel_tls_handshake_io, condition,
data, qio_channel_tls_handshake_io,
NULL, data,
context); NULL,
context);
} }
} }
@ -215,6 +216,7 @@ static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
QIOChannelTLS *tioc = QIO_CHANNEL_TLS( QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
qio_task_get_source(task)); qio_task_get_source(task));
tioc->hs_ioc_tag = 0;
g_free(data); g_free(data);
qio_channel_tls_handshake_task(tioc, task, context); qio_channel_tls_handshake_task(tioc, task, context);
@ -374,6 +376,10 @@ static int qio_channel_tls_close(QIOChannel *ioc,
{ {
QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
if (tioc->hs_ioc_tag) {
g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
}
return qio_channel_close(tioc->master, errp); return qio_channel_close(tioc->master, errp);
} }