From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Date: Tue, 24 Mar 2020 15:36:29 +0000 (+0300)
Subject: migration/ram: fix use after free of local_err
X-Git-Tag: v4.2.1~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c8d9fb334322762fe2feefa3c6d29571ddea513;p=thirdparty%2Fqemu.git

migration/ram: fix use after free of local_err

local_err is used again in migration_bitmap_sync_precopy() after
precopy_notify(), so we must zero it. Otherwise try to set
non-NULL local_err will crash.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200324153630.11882-6-vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
(cherry picked from commit b4a1733c5e6827c72b0dcfa295e07ef7b1ebccff)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/migration/ram.c b/migration/ram.c
index b6de7d1d555..c44542175da 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -1906,6 +1906,7 @@ static void migration_bitmap_sync_precopy(RAMState *rs)
      */
     if (precopy_notify(PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC, &local_err)) {
         error_report_err(local_err);
+        local_err = NULL;
     }
 
     migration_bitmap_sync(rs);