xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-24 03:59:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
c1bf3531ae
xemu/net
History
Marc-André Lureau c1bf3531ae vhost-user: fix use after free 
"name" is freed after visiting options, instead use the first NetClientState
name. Adds a few assert() for clarifying and checking some impossible states.

READ of size 1 at 0x602000000990 thread T0
    #0 0x7f6b251c570c  (/lib64/libasan.so.2+0x4770c)
    #1 0x5566dc380600 in qemu_find_net_clients_except net/net.c:824
    #2 0x5566dc39bac7 in net_vhost_user_event net/vhost-user.c:193
    #3 0x5566dbee862a in qemu_chr_be_event /home/elmarco/src/qemu/qemu-char.c:201
    #4 0x5566dbef2890 in tcp_chr_disconnect /home/elmarco/src/qemu/qemu-char.c:2790
    #5 0x5566dbef2d0b in tcp_chr_sync_read /home/elmarco/src/qemu/qemu-char.c:2835
    #6 0x5566dbee8a99 in qemu_chr_fe_read_all /home/elmarco/src/qemu/qemu-char.c:295
    #7 0x5566dc39b964 in net_vhost_user_watch net/vhost-user.c:180
    #8 0x5566dc5a06c7 in qio_channel_fd_source_dispatch io/channel-watch.c:70
    #9 0x7f6b1aa2ab87 in g_main_dispatch /home/elmarco/src/gnome/glib/glib/gmain.c:3154
    #10 0x7f6b1aa2b9cb in g_main_context_dispatch /home/elmarco/src/gnome/glib/glib/gmain.c:3769
    #11 0x5566dc475ed4 in glib_pollfds_poll /home/elmarco/src/qemu/main-loop.c:212
    #12 0x5566dc476029 in os_host_main_loop_wait /home/elmarco/src/qemu/main-loop.c:257
    #13 0x5566dc476165 in main_loop_wait /home/elmarco/src/qemu/main-loop.c:505
    #14 0x5566dbf08d31 in main_loop /home/elmarco/src/qemu/vl.c:1932
    #15 0x5566dbf16783 in main /home/elmarco/src/qemu/vl.c:4646
    #16 0x7f6b180bb57f in __libc_start_main (/lib64/libc.so.6+0x2057f)
    #17 0x5566dbbf5348 in _start (/home/elmarco/src/qemu/x86_64-softmmu/qemu-system-x86_64+0x3f9348)

0x602000000990 is located 0 bytes inside of 5-byte region [0x602000000990,0x602000000995)
freed by thread T0 here:
    #0 0x7f6b2521666a in __interceptor_free (/lib64/libasan.so.2+0x9866a)
    #1 0x7f6b1aa332a4 in g_free /home/elmarco/src/gnome/glib/glib/gmem.c:189
    #2 0x5566dc5f416f in qapi_dealloc_type_str qapi/qapi-dealloc-visitor.c:134
    #3 0x5566dc5f3268 in visit_type_str qapi/qapi-visit-core.c:196
    #4 0x5566dc5ced58 in visit_type_Netdev_fields /home/elmarco/src/qemu/qapi-visit.c:5936
    #5 0x5566dc5cef71 in visit_type_Netdev /home/elmarco/src/qemu/qapi-visit.c:5960
    #6 0x5566dc381a8d in net_visit net/net.c:1049
    #7 0x5566dc381c37 in net_client_init net/net.c:1076
    #8 0x5566dc3839e2 in net_init_netdev net/net.c:1473
    #9 0x5566dc63cc0a in qemu_opts_foreach util/qemu-option.c:1112
    #10 0x5566dc383b36 in net_init_clients net/net.c:1499
    #11 0x5566dbf15d86 in main /home/elmarco/src/qemu/vl.c:4397
    #12 0x7f6b180bb57f in __libc_start_main (/lib64/libc.so.6+0x2057f)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-03-11 16:59:12 +02:00
..
checksum.c net: check packet payload length 2016-03-08 15:34:18 +08:00
clients.h net: Permit incremental conversion of init functions to Error 2015-05-27 09:51:04 +01:00
dump.c qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
eth.c net: Clean up includes 2016-02-04 17:41:30 +00:00
filter-buffer.c filter-buffer: Add status_changed callback processing 2016-03-08 15:34:18 +08:00
filter.c filter: Add 'status' property for filter object 2016-03-08 15:34:18 +08:00
hub.c net: Clean up includes 2016-02-04 17:41:30 +00:00
hub.h net: fix qemu_flush_queued_packets() in presence of a hub 2013-02-27 16:10:23 +01:00
l2tpv3.c net: Clean up includes 2016-02-04 17:41:30 +00:00
Makefile.objs netfilter: add a netbuffer filter 2015-10-12 13:31:28 +08:00
net.c qapi-dealloc: Reduce use outside of generated code 2016-03-04 17:16:32 +01:00
netmap.c net: netmap: probe netmap interface for virtio-net header 2016-03-08 15:34:18 +08:00
queue.c net: Clean up includes 2016-02-04 17:41:30 +00:00
slirp.c net: Clean up includes 2016-02-04 17:41:30 +00:00
socket.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap_int.h tap: add VNET_LE/VNET_BE operations 2015-06-17 17:12:54 +02:00
tap-aix.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap-bsd.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap-haiku.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap-linux.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap-linux.h all: Clean up includes 2016-02-23 12:43:05 +00:00
tap-solaris.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap-win32.c net: Clean up includes 2016-02-04 17:41:30 +00:00
tap.c net: simplify net_init_tap_one logic 2016-03-08 15:34:09 +08:00
util.c net: Clean up includes 2016-02-04 17:41:30 +00:00
util.h all: Clean up includes 2016-02-23 12:43:05 +00:00
vde.c net: Clean up includes 2016-02-04 17:41:30 +00:00
vhost-user.c vhost-user: fix use after free 2016-03-11 16:59:12 +02:00