From f9c8caa04f7f2bed12dc5a4d7e92a59fe6677b37 Mon Sep 17 00:00:00 2001 From: Vladimir Sementsov-Ogievskiy Date: Sat, 25 Feb 2017 22:31:55 +0300 Subject: [PATCH] migration: fix use-after-free of to_dst_file hmp_savevm calls qemu_savevm_state(f), which sets to_dst_file=f in global migration state. Then hmp_savevm closes f (g_free called). Next access to to_dst_file in migration state (for example, qmp_migrate_set_speed) will use it after it was freed. Signed-off-by: Vladimir Sementsov-Ogievskiy Reviewed-by: Dr. David Alan Gilbert Message-Id: <20170225193155.447462-5-vsementsov@virtuozzo.com> Signed-off-by: Dr. David Alan Gilbert --- migration/savevm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/migration/savevm.c b/migration/savevm.c index 87c7a00832..26d2c44b5e 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -1277,6 +1277,11 @@ done: status = MIGRATION_STATUS_COMPLETED; } migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status); + + /* f is outer parameter, it should not stay in global migration state after + * this function finished */ + ms->to_dst_file = NULL; + return ret; }