a03e6f9210
qemu: Add missing lock in qemuProcessHandleMonitorEOF (CVE-2021-3975) Signed-off-by: yezengruan <yezengruan@huawei.com>
39 lines
1.4 KiB
Diff
39 lines
1.4 KiB
Diff
From baaf85d9c8b304c6cc95a892fc23962e8175a817 Mon Sep 17 00:00:00 2001
|
|
From: Peng Liang <liangpeng10@huawei.com>
|
|
Date: Wed, 24 Feb 2021 19:28:23 +0800
|
|
Subject: [PATCH] qemu: Add missing lock in qemuProcessHandleMonitorEOF
|
|
|
|
qemuMonitorUnregister will be called in multiple threads (e.g. threads
|
|
in rpc worker pool and the vm event thread). In some cases, it isn't
|
|
protected by the monitor lock, which may lead to call g_source_unref
|
|
more than one time and a use-after-free problem eventually.
|
|
|
|
Add the missing lock in qemuProcessHandleMonitorEOF (which is the only
|
|
position missing lock of monitor I found).
|
|
|
|
Suggested-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
|
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
---
|
|
src/qemu/qemu_process.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
index 6b9f6fb860..9701bb398b 100644
|
|
--- a/src/qemu/qemu_process.c
|
|
+++ b/src/qemu/qemu_process.c
|
|
@@ -315,7 +315,9 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon,
|
|
/* We don't want this EOF handler to be called over and over while the
|
|
* thread is waiting for a job.
|
|
*/
|
|
+ virObjectLock(mon);
|
|
qemuMonitorUnregister(mon);
|
|
+ virObjectUnlock(mon);
|
|
|
|
/* We don't want any cleanup from EOF handler (or any other
|
|
* thread) to enter qemu namespace. */
|
|
--
|
|
2.27.0
|
|
|