Browse Source

migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()

Coverity points out (CID 1400442) that in this code:

    if (packet->pages_alloc > p->pages->allocated) {
        multifd_pages_clear(p->pages);
        multifd_pages_init(packet->pages_alloc);
    }

we free p->pages in multifd_pages_clear() but continue to
use it in the following code. We also leak memory, because
multifd_pages_init() returns the pointer to a new MultiFDPages_t
struct but we are ignoring its return value.

Fix both of these bugs by adding the missing assignment of
the newly created struct to p->pages.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 2019040915.6024-1-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
tags/v4.0.0-rc3
Peter Maydell 3 months ago
parent
commit
f151f8aca5
1 changed files with 1 additions and 1 deletions
  1. 1
    1
      migration/ram.c

+ 1
- 1
migration/ram.c View File

@@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp)
851 851
      */
852 852
     if (packet->pages_alloc > p->pages->allocated) {
853 853
         multifd_pages_clear(p->pages);
854
-        multifd_pages_init(packet->pages_alloc);
854
+        p->pages = multifd_pages_init(packet->pages_alloc);
855 855
     }
856 856
 
857 857
     p->pages->used = be32_to_cpu(packet->pages_used);

Loading…
Cancel
Save