From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PA4PR04CU001.outbound.protection.outlook.com (mail-francecentralazon11023091.outbound.protection.outlook.com [40.107.162.91]) by lore.virtuozzo.com (Postfix) with ESMTPS id C5792803C3 for ; Fri, 4 Sep 2026 19:04:55 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AvEl3w29mLfs9FHCzxn1NsFg12HG/sdX6io9S8s5ZwmYQEv3mhoiu91A3ROOIJ55hiY7yfPx2pgOBFTMLhFfQjwZyysbBk4qTXqCLDmgVGqN8afV9mQF7OZ7GN04T3xuoyPK8jJxXm+EAm02HSFVtefmjhn8yQW4Oq7myQ6TMeCcPwOwVq9+D391gBWb8NrYpJcywMhqDpewOch4RjlvnZhQjZEuQnFfTcjCE4srvxqS5HQmS6IQx0peStKqIvN7eSQaRcmIloXvQgVIdK6yMO2KmqJ2n1FP2YL//h/dCHiSEPw5Ptw8g9T1BH53A+7hucTnr7gQQsogKgBw9HwHxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FN57EPAEFaPShtbEAI60EbuKpPwvDQS6KEI/7E2j+UU=; b=ILrxgCsiA6Yy2mG43GZRWmcH1aa2pNV+P+fsNrmPCHC0Nu2JpC5RcJFDjQhrhBV3/Xxkno1kHK1AJlCAfYLHxoSoXvLitISOFKIrcxORrGCvw/NV9Iyhl2KlSy3YYRDRCYpndCzwZc/lMooVbneSo479ahI0zyIHxM8MiCPC9SrflMUH6ju6Sa+OLYsavnGRYJNBRKQwaPPxCCVjNswzBZVUVYXJpV+Hadmqan0QCJ6FIoL85H9x5XZ3avhAFZjgVh2tW8z189+bV+PiWzi0Xk29irehm8NGncBHsg2qq7nUQnqVdjvpQgP/HNdw+xkD1B86JzYQg3rdsHwhxzUptA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FN57EPAEFaPShtbEAI60EbuKpPwvDQS6KEI/7E2j+UU=; b=jd/5ThaCJCm1tCfF+24SL2rlY+nXzp3jCWH8J1nVRvUbvam3QPP27tDoTgND9ifWpu5D2XbxV9LgsBgW/KMeorDAuawoOZkC0NWpjahx2yIaRC76JdSIvFApKV9Y8nT7VqzywID6tK5Aeb5/H7ignbsDZDI9Bx+dFkt7psTzUSgoUKSP0/NebFhcKL89XGr/8cX62jbuIMhvOQUS1PePsl52EY5OOC3wXMyFNkuMS1167j14PrOL99x45VmjcYI5bJovW8wD721WfMSK/G6/LYCshqyrwbC1CYMVlJwOxcDGb72OkEa7714qUo4ZpRdQdhQTOq+rYw6D6y9YgfXLXA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from DBBPR08MB10650.eurprd08.prod.outlook.com (2603:10a6:10:52d::7) by DB9PR08MB9827.eurprd08.prod.outlook.com (2603:10a6:10:460::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 19:04:53 +0000 Received: from DBBPR08MB10650.eurprd08.prod.outlook.com ([fe80::1b2a:832c:d136:a37c]) by DBBPR08MB10650.eurprd08.prod.outlook.com ([fe80::1b2a:832c:d136:a37c%5]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 19:04:53 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH v2 01/13] migration/cpr: fix use-after-free in cpr_delete_fd() Date: Fri, 4 Sep 2026 22:04:31 +0300 Message-ID: <20260904190443.795902-2-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904190443.795902-1-andrey.drobyshev@virtuozzo.com> References: <20260904190443.795902-1-andrey.drobyshev@virtuozzo.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: VI1PR07CA0215.eurprd07.prod.outlook.com (2603:10a6:802:58::18) To DBBPR08MB10650.eurprd08.prod.outlook.com (2603:10a6:10:52d::7) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DBBPR08MB10650:EE_|DB9PR08MB9827:EE_ X-MS-Office365-Filtering-Correlation-Id: 0e6ec193-43d5-4746-fbfc-08df0ab76704 List-Id: svt-core@virtuozzo.com X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|52116014|1800799024|23010399003|366016|38350700014|10067099003|22082099003|5113699003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: e0NkA8JJaReNWSkDE46O4HFze9YctvILqHEh1uuPH/9WdIYhgqsOoPVjfYA7upbavkYTMVjral+AdMVtPTeNDOT0S0gjilqrWaXE6d35ooeSovIfYGEPqH8wHnPXTubmfqY1icZ6V8fNwZ94v0szkPZatCXXZ4b8PwzsBlyiXQVqoQGLh0lGsbI7+RFrFM3uFbSXD+hn3+OSpS1SXrytn0wPoP95buveIbNcAYoyunVGyu/kCbPAsuUUshbPNiJvxzm0T1/xnzSHPW4vEOyPgkWcrkmfkHND49w/dMfwluPWgxAJnU/kMy8qe9EgCWowUmKWsh94nrvn5v5m4PMrOPGSj7BAXyPrLA/2jO66RlZdbxbNhuwCmWvI5UzWMMyf6EYSGvQmns8UajVpz2az8kOjeVpTcQ40fQoS90IqLT7AhXVNtaHIWB217iwRJj5BqKci9hOasZLBEkKOyRPXxy67d87kinmG0SL8Mi5HYgA9s230K4h/Nqrxtuw+G10+TEfxmuJlu57FI6Uv/jvlL8Z8B9qD74t/N9DDZdTjE9tRl/GH09ST1lYBcOy6c1CvKWkMbc+dPNKfhEjexG2x+EYUTYhESxidcGE9q+W/TNOPL+46ySiHeCie+rf0vx/Fu7ZWx76Tz1bk+F/MRA1Z0VOcJNB35wh4BPC2PMAKk3lEpOPNcvP8y9+28LyfRaNW/kvtkHzoeSNLerQPF2acww== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DBBPR08MB10650.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(52116014)(1800799024)(23010399003)(366016)(38350700014)(10067099003)(22082099003)(5113699003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rEEsZXOxmj1GAZRRAuulwgdcPy93lmyxAxsZb+Ky6NVQxtvuNLhvg75gdfVv?= =?us-ascii?Q?fy+2xOBcxUtPN9tiEoJS0Haz5vlRoErus7KLsQhUS45Fcvl8mjMEB694Z8F0?= =?us-ascii?Q?oJeM/yMIDbfo3U5jq5R/CrLqR7zHvWYdSxeL+oScGuWgLjp66CkV5mS2BNFF?= =?us-ascii?Q?zrJ5wxhHVpFu93YCsS5wHin0BJBt/KdBMl56Nk5Jom85hOoCYLoco2MlpRuE?= =?us-ascii?Q?NVD5ZRPcfmFMM7mmS1QIQkGxocvPtwKeCtJlBoysY15DnQ5mwiLeB2T8Qypi?= =?us-ascii?Q?t1k+FkiuYS1I44Ta1KTd48VgNVJygvqKQDKXtPtaj+FM4rNSnvzMNlNHIxwy?= =?us-ascii?Q?BjlWsNzECtFy1zxVBUC4qnINGZKPvcZxbwKn4tRL/dZF/heuFTVJ+SmegkV4?= =?us-ascii?Q?6MVatw0tAeqpENoRlgC2bV2H/ZOQGDRB5o3YAz4wzrXMNbMeBQzC/JeXUpTo?= =?us-ascii?Q?N1ZVYIevnN5ekxDJlYs+Stdn79Yn0WbwXqTC9oJBVzTNtIaY9Q5mmLW3m2Nn?= =?us-ascii?Q?weRr7PCa4kwJ3PkaBxYs4WirJNTu5jUgte9E/TdJsNbXAuydNNEqd8XCzHeH?= =?us-ascii?Q?/qxcRmmm55KKc9rEvBdggLiYi2+qx3OR+ynuZEFwOjNpEHWIko3XekHBMqZR?= =?us-ascii?Q?nnCmF5l2MG77/U6D+e7qX+EY/fcDa/G4gMs8RWyszEbj3H7mnjp1v9jEVPb4?= =?us-ascii?Q?wuvYYLu0GbvX3uHITKfHQCvIBVdNqW3O0by6Ks9hAk7p4j1K7g5JodKTU9oM?= =?us-ascii?Q?lxean48slkc7/42va2XbBU962KassH/qOKpOgZ5UCM9l4vDXFK6V4qrLyKky?= =?us-ascii?Q?dO5UchY1qHKoUskLfI8PYYef2e2AUVOs4kxhxHzJWBNeIMSTVMNdvq21o1Pn?= =?us-ascii?Q?JhR0zAjjD0B+zqpd3ep0TSzVKYbhUhUAm9MYK/RPQS65UtHlwt940NfKRPC2?= =?us-ascii?Q?3+sXmJ49tz2EcZZ5u2Ea0n3q9bau6fx+XIp0q9B5Y+Z5eMMFb33Yor5g1T/S?= =?us-ascii?Q?6jDmWUhm3wLquWZEKHXDZISDXTVTlI0C7jq5amlAQQr+wowo0pfCR/F4SqtV?= =?us-ascii?Q?7D51SEvTGSmlKC1+yZps4Bxq85dn9V4zbrbxKIiDHWzvxNlCGfkAhCBfQneU?= =?us-ascii?Q?5NoNxWPplwhmWGjnDdCxwjINcbmTjDDzjunbJ8btzTL6dAQw3qsQ5tDoa/Jd?= =?us-ascii?Q?pOty/GhgS9qXDjocgW6YECdMqvanPdlgp9sslWIouZiw0xQTgxh9yIvjxg4B?= =?us-ascii?Q?XiDfw/FZ80BxzybBi+HFuJBvhk01FtD2RYJOTkN4bIIyWQVp2AapPg9bUyfU?= =?us-ascii?Q?C/LVZqurlNM6say/XiDHNKovDwjD9eC8I1YaHA1RbVnNZ/uQPiTTNx4cMS2F?= =?us-ascii?Q?Bb3S0E6GUxkey8W2Hqbcwm7K4DMoRooy2SHcAQeBM0oxEPH4WuXb3jdULPY4?= =?us-ascii?Q?T03HX6PJKWegKr6ddRk9TogJ2NUmvCROFX06kVGmO4Xvi3m4F6yTV5FdOjn8?= =?us-ascii?Q?4MnydzfSTYV8/c/CXIDHz/VoCaJf2B8t82msF/MSgVD0D5lkhUWK48xFRN8a?= =?us-ascii?Q?NSw1vA5wgLnMHVE91LKu31hKEQdUBWswzGni8RNOYzep0e1viBKeCpsz7WS2?= =?us-ascii?Q?rLzuOVh21gLlKH1n5tJ+aRJ0c6Lb++ypo5lB9G4gLtmafCsMPgQhzBEG7iDf?= =?us-ascii?Q?7d4lrL4e5vDbq3k8FNf9//TPKOzDoWtz6MDhR1hlGEWft7R46Mvac+wZGEaj?= =?us-ascii?Q?21REAHpmFZLnbRwMY3melTzlECij5tQ=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0e6ec193-43d5-4746-fbfc-08df0ab76704 X-MS-Exchange-CrossTenant-AuthSource: DBBPR08MB10650.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 19:04:53.7590 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +sB6wYTD1eWvMhxqHRlVLRalW7V0Ey2hROfisOQo02cfc5nt/LSQvN2AlvGpAyfFohyuNbTIfJvC/qr4SO0RcGkP8aq7W0P/Jz+DtlypdOg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB9827 cpr_delete_fd() frees the CprFd element and then reads elem->fd in the trace_cpr_delete_fd() call at the end of the function - a use-after-free. It is benign in practice, since the freed slot is not reused between the free and the trace, so the trace just logs a stale fd; but it is a real error and AddressSanitizer reports it for every cpr_delete_fd() that removes an entry, e.g. from the chardev socket path during cpr-transfer. Read elem->fd into a local before freeing the element. Fixes: a7ef60328867 ("migration/cpr: add fd number to cpr_delete_fd() tracepoint") Signed-off-by: Andrey Drobyshev --- migration/cpr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/migration/cpr.c b/migration/cpr.c index 1d484790b9e..f218e6a66d6 100644 --- a/migration/cpr.c +++ b/migration/cpr.c @@ -110,6 +110,7 @@ static CprFd *find_fd(CprFdList *head, const char *name, int id) void cpr_delete_fd(const char *name, int id) { CprFd *elem = find_fd(&cpr_state.fds, name, id); + int fd = elem ? elem->fd : -1; if (elem) { QLIST_REMOVE(elem, next); @@ -117,7 +118,7 @@ void cpr_delete_fd(const char *name, int id) g_free(elem); } - trace_cpr_delete_fd(name, id, elem ? elem->fd : -1); + trace_cpr_delete_fd(name, id, fd); } void cpr_delete_fd_all(const char *name) -- 2.47.1