From abe2c4bdb65e8dd9cb2f01c355baa394bf49a8af Mon Sep 17 00:00:00 2001 From: Eric Auger Date: Tue, 28 Feb 2023 10:29:44 +0100 Subject: [PATCH 1/2] test-vmstate: fix bad GTree usage, use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit According to g_tree_foreach() documentation: "The tree may not be modified while iterating over it (you can't add/remove items)." compare_trees()/diff_tree() fail to respect this rule. Historically GLib2 used a slice allocator for the GTree APIs which did not immediately release the memory back to the system allocator. As a result QEMU's use-after-free bug was not visible. With GLib > 2.75.3 however, GLib2 has switched to using malloc and now a SIGSEGV can be observed while running test-vmstate. Get rid of the node removal within the tree traversal. Also check the trees have the same number of nodes before the actual diff. Fixes: 9a85e4b8f6 ("migration: Support gtree migration") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518 Signed-off-by: Marc-André Lureau Signed-off-by: Eric Auger Reported-by: Richard W.M. Jones Tested-by: Richard W.M. Jones Reviewed-by: Richard W.M. Jones Reviewed-by: Daniel P. Berrangé Reviewed-by: Juan Quintela Signed-off-by: Juan Quintela --- tests/unit/test-vmstate.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tests/unit/test-vmstate.c b/tests/unit/test-vmstate.c index 79357b29ca..0b7d5ecd68 100644 --- a/tests/unit/test-vmstate.c +++ b/tests/unit/test-vmstate.c @@ -1073,7 +1073,6 @@ static gboolean diff_tree(gpointer key, gpointer value, gpointer data) struct match_node_data d = {tp->tree2, key, value}; g_tree_foreach(tp->tree2, tp->match_node, &d); - g_tree_remove(tp->tree1, key); return false; } @@ -1082,9 +1081,9 @@ static void compare_trees(GTree *tree1, GTree *tree2, { struct tree_cmp_data tp = {tree1, tree2, function}; + assert(g_tree_nnodes(tree1) == g_tree_nnodes(tree2)); g_tree_foreach(tree1, diff_tree, &tp); - assert(g_tree_nnodes(tree1) == 0); - assert(g_tree_nnodes(tree2) == 0); + g_tree_destroy(g_tree_ref(tree1)); } static void diff_domain(TestGTreeDomain *d1, TestGTreeDomain *d2) From c31772ad6883533757d2a7dfe9ce24325e3ec16c Mon Sep 17 00:00:00 2001 From: "John Berberian, Jr" Date: Sun, 15 Jan 2023 20:34:21 -0500 Subject: [PATCH 2/2] Fix exec migration on Windows (w32+w64). * Use cmd instead of /bin/sh on Windows. * Try to auto-detect cmd.exe's path, but default to a hard-coded path. Note that this will require that gspawn-win[32|64]-helper.exe and gspawn-win[32|64]-helper-console.exe are included in the Windows binary distributions (cc: Stefan Weil). Signed-off-by: "John Berberian, Jr" Reviewed-by: Juan Quintela Signed-off-by: Juan Quintela --- migration/exec.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/migration/exec.c b/migration/exec.c index 375d2e1b54..38604d73a6 100644 --- a/migration/exec.c +++ b/migration/exec.c @@ -23,12 +23,31 @@ #include "migration.h" #include "io/channel-command.h" #include "trace.h" +#include "qemu/cutils.h" +#ifdef WIN32 +const char *exec_get_cmd_path(void); +const char *exec_get_cmd_path(void) +{ + g_autofree char *detected_path = g_new(char, MAX_PATH); + if (GetSystemDirectoryA(detected_path, MAX_PATH) == 0) { + warn_report("Could not detect cmd.exe path, using default."); + return "C:\\Windows\\System32\\cmd.exe"; + } + pstrcat(detected_path, MAX_PATH, "\\cmd.exe"); + return g_steal_pointer(&detected_path); +} +#endif void exec_start_outgoing_migration(MigrationState *s, const char *command, Error **errp) { QIOChannel *ioc; + +#ifdef WIN32 + const char *argv[] = { exec_get_cmd_path(), "/c", command, NULL }; +#else const char *argv[] = { "/bin/sh", "-c", command, NULL }; +#endif trace_migration_exec_outgoing(command); ioc = QIO_CHANNEL(qio_channel_command_new_spawn(argv, @@ -55,7 +74,12 @@ static gboolean exec_accept_incoming_migration(QIOChannel *ioc, void exec_start_incoming_migration(const char *command, Error **errp) { QIOChannel *ioc; + +#ifdef WIN32 + const char *argv[] = { exec_get_cmd_path(), "/c", command, NULL }; +#else const char *argv[] = { "/bin/sh", "-c", command, NULL }; +#endif trace_migration_exec_incoming(command); ioc = QIO_CHANNEL(qio_channel_command_new_spawn(argv,