thebeanogamer / rpms / qemu-kvm

Forked from rpms/qemu-kvm 5 months ago
Clone

Blame SOURCES/kvm-Migration-TLS-Fix-crash-due-to-double-cleanup.patch

ae23c9
From 699be60852400ad3459992a02c8477c08944ad09 Mon Sep 17 00:00:00 2001
ae23c9
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
ae23c9
Date: Wed, 1 Aug 2018 13:55:18 +0100
ae23c9
Subject: [PATCH] Migration+TLS: Fix crash due to double cleanup
ae23c9
MIME-Version: 1.0
ae23c9
Content-Type: text/plain; charset=UTF-8
ae23c9
Content-Transfer-Encoding: 8bit
ae23c9
ae23c9
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
ae23c9
Message-id: <20180801135522.11658-15-dgilbert@redhat.com>
ae23c9
Patchwork-id: 81569
ae23c9
O-Subject: [qemu-kvm RHEL8/virt212 PATCH 14/18] Migration+TLS: Fix crash due to double cleanup
ae23c9
Bugzilla: 1594384
ae23c9
RH-Acked-by: Peter Xu <peterx@redhat.com>
ae23c9
RH-Acked-by: John Snow <jsnow@redhat.com>
ae23c9
RH-Acked-by: Juan Quintela <quintela@redhat.com>
ae23c9
ae23c9
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
ae23c9
ae23c9
During a TLS connect we see:
ae23c9
  migration_channel_connect calls
ae23c9
  migration_tls_channel_connect
ae23c9
  (calls after TLS setup)
ae23c9
  migration_channel_connect
ae23c9
ae23c9
My previous error handling fix made migration_channel_connect
ae23c9
call migrate_fd_connect in all cases; unfortunately the above
ae23c9
means it gets called twice and crashes doing double cleanup.
ae23c9
ae23c9
Fixes: 688a3dcba98
ae23c9
ae23c9
Reported-by: Peter Krempa <pkrempa@redhat.com>
ae23c9
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
ae23c9
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
ae23c9
Message-Id: <20180430185943.35714-1-dgilbert@redhat.com>
ae23c9
Signed-off-by: Juan Quintela <quintela@redhat.com>
ae23c9
(cherry picked from commit 8b7bf2badac25c0a52aff1b181ad75fdb304dd0c)
ae23c9
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
ae23c9
---
ae23c9
 migration/channel.c | 9 +++++++++
ae23c9
 1 file changed, 9 insertions(+)
ae23c9
ae23c9
diff --git a/migration/channel.c b/migration/channel.c
ae23c9
index c5eaf0f..7a32b5a 100644
ae23c9
--- a/migration/channel.c
ae23c9
+++ b/migration/channel.c
ae23c9
@@ -71,6 +71,15 @@ void migration_channel_connect(MigrationState *s,
ae23c9
             !object_dynamic_cast(OBJECT(ioc),
ae23c9
                                  TYPE_QIO_CHANNEL_TLS)) {
ae23c9
             migration_tls_channel_connect(s, ioc, hostname, &error);
ae23c9
+
ae23c9
+            if (!error) {
ae23c9
+                /* tls_channel_connect will call back to this
ae23c9
+                 * function after the TLS handshake,
ae23c9
+                 * so we mustn't call migrate_fd_connect until then
ae23c9
+                 */
ae23c9
+
ae23c9
+                return;
ae23c9
+            }
ae23c9
         } else {
ae23c9
             QEMUFile *f = qemu_fopen_channel_output(ioc);
ae23c9
 
ae23c9
-- 
ae23c9
1.8.3.1
ae23c9