fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails

Browse source 
Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com

Fix the issue by moving the error_setg_errno() earlier.  When at it, clear
argv variable after freed.

Resolves: Coverity CID 1641397
Fixes: a3eae205c6 ("migration: cpr-exec mode")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
This commit is contained in:
Peter Xu 2025-10-21 18:04:06 -04:00
parent 6a65fdee8a
commit 89471ef237
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
migration/cpr-exec.c
View file

@ -152,10 +152,10 @@ static void cpr_exec_cb(void *opaque)
* exec should only fail if argv[0] is bogus, or has a permissions problem,
* or the system is very short on resources.
*/
g_strfreev(argv);
error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
g_clear_pointer(&argv, g_strfreev);
cpr_exec_unpreserve_fds();
error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
error_report_err(error_copy(err));
migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
migrate_set_error(s, err);