diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2020-04-20 13:20:12 +0200 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2020-07-13 11:59:47 +0400 |
| commit | 6806601969a0d6c095e3836423fef1dedec55289 (patch) | |
| tree | d280ebc01c64f9583457a0651606ebc9870ac0c2 /chardev | |
| parent | 14a7a203063694ff932f3371ed93e97987dcafc0 (diff) | |
| download | qemu-6806601969a0d6c095e3836423fef1dedec55289.zip qemu-6806601969a0d6c095e3836423fef1dedec55289.tar.gz qemu-6806601969a0d6c095e3836423fef1dedec55289.tar.bz2 | |
char: fix use-after-free with dup chardev & reconnect
With a reconnect socket, qemu_char_open() will start a background
thread. It should keep a reference on the chardev.
Fixes invalid read:
READ of size 8 at 0x6040000ac858 thread T7
#0 0x5555598d37b8 in unix_connect_saddr /home/elmarco/src/qq/util/qemu-sockets.c:954
#1 0x5555598d4751 in socket_connect /home/elmarco/src/qq/util/qemu-sockets.c:1109
#2 0x555559707c34 in qio_channel_socket_connect_sync /home/elmarco/src/qq/io/channel-socket.c:145
#3 0x5555596adebb in tcp_chr_connect_client_task /home/elmarco/src/qq/chardev/char-socket.c:1104
#4 0x555559723d55 in qio_task_thread_worker /home/elmarco/src/qq/io/task.c:123
#5 0x5555598a6731 in qemu_thread_start /home/elmarco/src/qq/util/qemu-thread-posix.c:519
#6 0x7ffff40d4431 in start_thread (/lib64/libpthread.so.0+0x9431)
#7 0x7ffff40029d2 in __clone (/lib64/libc.so.6+0x1019d2)
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20200420112012.567284-1-marcandre.lureau@redhat.com>
Diffstat (limited to 'chardev')
| -rw-r--r-- | chardev/char-socket.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/chardev/char-socket.c b/chardev/char-socket.c index 320aa7c..ef62dbf 100644 --- a/chardev/char-socket.c +++ b/chardev/char-socket.c @@ -1129,7 +1129,8 @@ static void tcp_chr_connect_client_async(Chardev *chr) */ s->connect_task = qio_task_new(OBJECT(sioc), qemu_chr_socket_connected, - chr, NULL); + object_ref(OBJECT(chr)), + (GDestroyNotify)object_unref); qio_task_run_in_thread(s->connect_task, tcp_chr_connect_client_task, s->addr, |