From nobody Sat May 18 21:45:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; t=1563390451; cv=none; d=zoho.com; s=zohoarc; b=Zti9jgytB7+WwNzb7I1hPHTQjpCnooGi8X83D7wLw5IEXX8FVuMCoZKQ0ufQoBN4dupmbEYTjr1B2+Dxb5LtKFGVRXxpPm6QUqS/og9fFIeK3bfRsHeFqd7juDrPG5H0/TZenNIODkWMshh08WJb/vhEOSuac5xTMAroy18lfsI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1563390451; h=Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:Sender:Subject:To:ARC-Authentication-Results; bh=IFrulDmYlx3DXAIunF+mTDyw0sg+HB+WPIM3riQChzA=; b=mEdGk49hDV0zPwxOFf8cmxQk3wMk06qP8lEFAFNrf1H4LNnwdKp7dkOzb3JXW3U8v41R+j+HIGTRmTvyYX6T9LX76tkjbquWg/CqYc4kkyU5UbrOB5GUqyF/s7Hp8mM3yurkQaWdvppITNUXXLt5JsqaTyRWZ8QpALaqm4H5uwA= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (209.51.188.17 [209.51.188.17]) by mx.zohomail.com with SMTPS id 1563390451510762.1528512238287; Wed, 17 Jul 2019 12:07:31 -0700 (PDT) Received: from localhost ([::1]:60016 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hnpGt-00055g-10 for importer@patchew.org; Wed, 17 Jul 2019 15:07:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:43259) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hnpGi-0004gk-VC for qemu-devel@nongnu.org; Wed, 17 Jul 2019 15:07:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hnpGh-0000cB-Sf for qemu-devel@nongnu.org; Wed, 17 Jul 2019 15:07:12 -0400 Received: from relay.sw.ru ([185.231.240.75]:40462) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hnpGh-0000Xx-Lg for qemu-devel@nongnu.org; Wed, 17 Jul 2019 15:07:11 -0400 Received: from [172.16.25.136] (helo=localhost.sw.ru) by relay.sw.ru with esmtp (Exim 4.92) (envelope-from ) id 1hnpGd-0002Un-CF; Wed, 17 Jul 2019 22:07:07 +0300 From: Andrey Shinkevich To: qemu-devel@nongnu.org Date: Wed, 17 Jul 2019 22:06:56 +0300 Message-Id: <1563390416-751339-1-git-send-email-andrey.shinkevich@virtuozzo.com> X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 185.231.240.75 Subject: [Qemu-devel] [PATCH] make check-unit: use after free in test-opts-visitor X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: den@openvz.org, vsementsov@virtuozzo.com, andrey.shinkevich@virtuozzo.com, mdroth@linux.vnet.ibm.com, armbru@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In struct OptsVisitor, repeated_opts member points to a list in the unprocessed_opts hash table after the list has been destroyed. A subsequent call to visit_type_int() references the deleted list. It results in use-after-free issue. Also, the Visitor object call back functions are supposed to set the Error parameter in case of failure. Signed-off-by: Andrey Shinkevich --- The issue was detected after running tests/test-opts-visitor under the Valg= rind tool: Invalid read of size 8 at 0x55ADB95: g_queue_peek_head (in /usr/lib64/libglib-2.0.so.0.5600.1) by 0x12FD97: lookup_scalar (opts-visitor.c:310) by 0x13008A: opts_type_int64 (opts-visitor.c:395) by 0x1299C8: visit_type_int (qapi-visit-core.c:149) by 0x119389: test_opts_range_beyond (test-opts-visitor.c:240) after Address 0x9563b30 is 0 bytes inside a block of size 24 free'd at 0x4C2ACBD: free (vg_replace_malloc.c:530) by 0x55A179D: g_free (in /usr/lib64/libglib-2.0.so.0.5600.1) by 0x55B92BF: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.5600.1) by 0x12F615: destroy_list (opts-visitor.c:102) by 0x558A859: ??? (in /usr/lib64/libglib-2.0.so.0.5600.1) by 0x12FC37: opts_next_list (opts-visitor.c:260) by 0x1296B1: visit_next_list (qapi-visit-core.c:88) by 0x119341: test_opts_range_beyond (test-opts-visitor.c:238) qapi/opts-visitor.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/qapi/opts-visitor.c b/qapi/opts-visitor.c index 324b197..e95f766 100644 --- a/qapi/opts-visitor.c +++ b/qapi/opts-visitor.c @@ -228,6 +228,7 @@ opts_start_list(Visitor *v, const char *name, GenericLi= st **list, size_t size, *list =3D g_malloc0(size); } else { *list =3D NULL; + error_setg(errp, QERR_MISSING_PARAMETER, name); } } =20 @@ -255,9 +256,14 @@ opts_next_list(Visitor *v, GenericList *tail, size_t s= ize) case LM_IN_PROGRESS: { const QemuOpt *opt; =20 + if (!ov->repeated_opts) { + return NULL; + } + opt =3D g_queue_pop_head(ov->repeated_opts); if (g_queue_is_empty(ov->repeated_opts)) { g_hash_table_remove(ov->unprocessed_opts, opt->name); + ov->repeated_opts =3D NULL; return NULL; } break; @@ -307,6 +313,10 @@ lookup_scalar(const OptsVisitor *ov, const char *name,= Error **errp) return list ? g_queue_peek_tail(list) : NULL; } assert(ov->list_mode =3D=3D LM_IN_PROGRESS); + if (!ov->repeated_opts) { + error_setg(errp, QERR_INVALID_PARAMETER, name); + return NULL; + } return g_queue_peek_head(ov->repeated_opts); } =20 --=20 1.8.3.1