[QEMU HCI-8.0 PATCH v2 01/13] migration/cpr: fix use-after-free in cpr_delete_fd()

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

cpr_delete_fd() frees the CprFd element and then reads elem->fd in the
trace_cpr_delete_fd() call at the end of the function - a use-after-free.
It is benign in practice, since the freed slot is not reused between the
free and the trace, so the trace just logs a stale fd; but it is a real
error and AddressSanitizer reports it for every cpr_delete_fd() that
removes an entry, e.g. from the chardev socket path during cpr-transfer.

Read elem->fd into a local before freeing the element.

Fixes: a7ef60328867 ("migration/cpr: add fd number to cpr_delete_fd() tracepoint")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
---
 migration/cpr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/migration/cpr.c b/migration/cpr.c
index 1d484790b9e..f218e6a66d6 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -110,6 +110,7 @@ static CprFd *find_fd(CprFdList *head, const char *name, int id)
 void cpr_delete_fd(const char *name, int id)
 {
     CprFd *elem = find_fd(&cpr_state.fds, name, id);
+    int fd = elem ? elem->fd : -1;
 
     if (elem) {
         QLIST_REMOVE(elem, next);
@@ -117,7 +118,7 @@ void cpr_delete_fd(const char *name, int id)
         g_free(elem);
     }
 
-    trace_cpr_delete_fd(name, id, elem ? elem->fd : -1);
+    trace_cpr_delete_fd(name, id, fd);
 }
 
 void cpr_delete_fd_all(const char *name)
-- 
2.47.1