[PATCH 3/3] migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails

Peter Xu posted 3 patches 3 weeks, 3 days ago
Maintainers: Steve Sistare <steven.sistare@oracle.com>, Peter Xu <peterx@redhat.com>, Fabiano Rosas <farosas@suse.de>
There is a newer version of this series
[PATCH 3/3] migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails
Posted by Peter Xu 3 weeks, 3 days ago
Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com

Fix the issue by moving the error_setg_errno() earlier.  When at it, clear
argv variable after freed.

Resolves: Coverity CID 1641397
Fixes: a3eae205c6 ("migration: cpr-exec mode")
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/cpr-exec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index 3cf44634a9..15c9895a11 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -149,10 +149,10 @@ static void cpr_exec_cb(void *opaque)
      * exec should only fail if argv[0] is bogus, or has a permissions problem,
      * or the system is very short on resources.
      */
-    g_strfreev(argv);
+    error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
+    g_clear_pointer(&argv, g_strfreev);
     cpr_exec_unpreserve_fds();
 
-    error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
     error_report_err(error_copy(err));
     migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
     migrate_set_error(s, err);
-- 
2.50.1
Re: [PATCH 3/3] migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails
Posted by Fabiano Rosas 3 weeks, 2 days ago
Peter Xu <peterx@redhat.com> writes:

> Per reported and analyzed by Peter:
>
> https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com
>
> Fix the issue by moving the error_setg_errno() earlier.  When at it, clear
> argv variable after freed.
>
> Resolves: Coverity CID 1641397
> Fixes: a3eae205c6 ("migration: cpr-exec mode")
> Signed-off-by: Peter Xu <peterx@redhat.com>

Reviewed-by: Fabiano Rosas <farosas@suse.de>