mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 09:55:55 +00:00
monitor: fix use after free
The function monitor_fdset_dup_fd_find_remove() references member of 'mon_fdset' which - when remove flag is set - may be freed in function monitor_fdset_cleanup(). remove is set by monitor_fdset_dup_fd_remove which in practice does not need the returned value, so make it void, and return -1 from monitor_fdset_dup_fd_find_remove. Reported-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
This commit is contained in:
parent
2928207ac1
commit
b3dd1b8c29
|
@ -64,7 +64,7 @@ AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
|
||||||
Error **errp);
|
Error **errp);
|
||||||
int monitor_fdset_get_fd(int64_t fdset_id, int flags);
|
int monitor_fdset_get_fd(int64_t fdset_id, int flags);
|
||||||
int monitor_fdset_dup_fd_add(int64_t fdset_id, int dup_fd);
|
int monitor_fdset_dup_fd_add(int64_t fdset_id, int dup_fd);
|
||||||
int monitor_fdset_dup_fd_remove(int dup_fd);
|
void monitor_fdset_dup_fd_remove(int dup_fd);
|
||||||
int monitor_fdset_dup_fd_find(int dup_fd);
|
int monitor_fdset_dup_fd_find(int dup_fd);
|
||||||
|
|
||||||
#endif /* !MONITOR_H */
|
#endif /* !MONITOR_H */
|
||||||
|
|
|
@ -2542,11 +2542,13 @@ static int monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
|
||||||
if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
|
if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
|
||||||
monitor_fdset_cleanup(mon_fdset);
|
monitor_fdset_cleanup(mon_fdset);
|
||||||
}
|
}
|
||||||
}
|
return -1;
|
||||||
|
} else {
|
||||||
return mon_fdset->id;
|
return mon_fdset->id;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2555,9 +2557,9 @@ int monitor_fdset_dup_fd_find(int dup_fd)
|
||||||
return monitor_fdset_dup_fd_find_remove(dup_fd, false);
|
return monitor_fdset_dup_fd_find_remove(dup_fd, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
int monitor_fdset_dup_fd_remove(int dup_fd)
|
void monitor_fdset_dup_fd_remove(int dup_fd)
|
||||||
{
|
{
|
||||||
return monitor_fdset_dup_fd_find_remove(dup_fd, true);
|
monitor_fdset_dup_fd_find_remove(dup_fd, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
int monitor_handle_fd_param(Monitor *mon, const char *fdname)
|
int monitor_handle_fd_param(Monitor *mon, const char *fdname)
|
||||||
|
|
|
@ -1,7 +1,6 @@
|
||||||
#include "qemu-common.h"
|
#include "qemu-common.h"
|
||||||
#include "monitor/monitor.h"
|
#include "monitor/monitor.h"
|
||||||
|
|
||||||
int monitor_fdset_dup_fd_remove(int dupfd)
|
void monitor_fdset_dup_fd_remove(int dupfd)
|
||||||
{
|
{
|
||||||
return -1;
|
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue