* [PULL 1/2] test-vmstate: fix bad GTree usage, use-after-free
2023-03-02 16:19 [PULL 0/2] Migration 20230302 patches Juan Quintela
@ 2023-03-02 16:19 ` Juan Quintela
2023-03-02 16:19 ` [PULL 2/2] Fix exec migration on Windows (w32+w64) Juan Quintela
2023-03-04 13:59 ` [PULL 0/2] Migration 20230302 patches Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Juan Quintela @ 2023-03-02 16:19 UTC (permalink / raw)
To: qemu-devel
Cc: Dr. David Alan Gilbert, Juan Quintela, Eric Auger,
Marc-André Lureau, Richard W . M . Jones,
Daniel P . Berrangé
From: Eric Auger <eric.auger@redhat.com>
According to g_tree_foreach() documentation:
"The tree may not be modified while iterating over it (you can't
add/remove items)."
compare_trees()/diff_tree() fail to respect this rule.
Historically GLib2 used a slice allocator for the GTree APIs
which did not immediately release the memory back to the system
allocator. As a result QEMU's use-after-free bug was not visible.
With GLib > 2.75.3 however, GLib2 has switched to using malloc
and now a SIGSEGV can be observed while running test-vmstate.
Get rid of the node removal within the tree traversal. Also
check the trees have the same number of nodes before the actual
diff.
Fixes: 9a85e4b8f6 ("migration: Support gtree migration")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
tests/unit/test-vmstate.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/tests/unit/test-vmstate.c b/tests/unit/test-vmstate.c
index 79357b29ca..0b7d5ecd68 100644
--- a/tests/unit/test-vmstate.c
+++ b/tests/unit/test-vmstate.c
@@ -1073,7 +1073,6 @@ static gboolean diff_tree(gpointer key, gpointer value, gpointer data)
struct match_node_data d = {tp->tree2, key, value};
g_tree_foreach(tp->tree2, tp->match_node, &d);
- g_tree_remove(tp->tree1, key);
return false;
}
@@ -1082,9 +1081,9 @@ static void compare_trees(GTree *tree1, GTree *tree2,
{
struct tree_cmp_data tp = {tree1, tree2, function};
+ assert(g_tree_nnodes(tree1) == g_tree_nnodes(tree2));
g_tree_foreach(tree1, diff_tree, &tp);
- assert(g_tree_nnodes(tree1) == 0);
- assert(g_tree_nnodes(tree2) == 0);
+ g_tree_destroy(g_tree_ref(tree1));
}
static void diff_domain(TestGTreeDomain *d1, TestGTreeDomain *d2)
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PULL 2/2] Fix exec migration on Windows (w32+w64).
2023-03-02 16:19 [PULL 0/2] Migration 20230302 patches Juan Quintela
2023-03-02 16:19 ` [PULL 1/2] test-vmstate: fix bad GTree usage, use-after-free Juan Quintela
@ 2023-03-02 16:19 ` Juan Quintela
2023-03-04 13:59 ` [PULL 0/2] Migration 20230302 patches Peter Maydell
2 siblings, 0 replies; 4+ messages in thread
From: Juan Quintela @ 2023-03-02 16:19 UTC (permalink / raw)
To: qemu-devel; +Cc: Dr. David Alan Gilbert, Juan Quintela, John Berberian, Jr
From: "John Berberian, Jr" <jeb.study@gmail.com>
* Use cmd instead of /bin/sh on Windows.
* Try to auto-detect cmd.exe's path, but default to a hard-coded path.
Note that this will require that gspawn-win[32|64]-helper.exe and
gspawn-win[32|64]-helper-console.exe are included in the Windows binary
distributions (cc: Stefan Weil).
Signed-off-by: "John Berberian, Jr" <jeb.study@gmail.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
migration/exec.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/migration/exec.c b/migration/exec.c
index 375d2e1b54..38604d73a6 100644
--- a/migration/exec.c
+++ b/migration/exec.c
@@ -23,12 +23,31 @@
#include "migration.h"
#include "io/channel-command.h"
#include "trace.h"
+#include "qemu/cutils.h"
+#ifdef WIN32
+const char *exec_get_cmd_path(void);
+const char *exec_get_cmd_path(void)
+{
+ g_autofree char *detected_path = g_new(char, MAX_PATH);
+ if (GetSystemDirectoryA(detected_path, MAX_PATH) == 0) {
+ warn_report("Could not detect cmd.exe path, using default.");
+ return "C:\\Windows\\System32\\cmd.exe";
+ }
+ pstrcat(detected_path, MAX_PATH, "\\cmd.exe");
+ return g_steal_pointer(&detected_path);
+}
+#endif
void exec_start_outgoing_migration(MigrationState *s, const char *command, Error **errp)
{
QIOChannel *ioc;
+
+#ifdef WIN32
+ const char *argv[] = { exec_get_cmd_path(), "/c", command, NULL };
+#else
const char *argv[] = { "/bin/sh", "-c", command, NULL };
+#endif
trace_migration_exec_outgoing(command);
ioc = QIO_CHANNEL(qio_channel_command_new_spawn(argv,
@@ -55,7 +74,12 @@ static gboolean exec_accept_incoming_migration(QIOChannel *ioc,
void exec_start_incoming_migration(const char *command, Error **errp)
{
QIOChannel *ioc;
+
+#ifdef WIN32
+ const char *argv[] = { exec_get_cmd_path(), "/c", command, NULL };
+#else
const char *argv[] = { "/bin/sh", "-c", command, NULL };
+#endif
trace_migration_exec_incoming(command);
ioc = QIO_CHANNEL(qio_channel_command_new_spawn(argv,
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread