From: Eric Auger Date: Tue, 28 Feb 2023 09:29:44 +0000 (+0100) Subject: test-vmstate: fix bad GTree usage, use-after-free X-Git-Tag: v7.2.10~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=73bf928177b6e3c894de9fe3796161219a4e1412;p=thirdparty%2Fqemu.git test-vmstate: fix bad GTree usage, use-after-free According to g_tree_foreach() documentation: "The tree may not be modified while iterating over it (you can't add/remove items)." compare_trees()/diff_tree() fail to respect this rule. Historically GLib2 used a slice allocator for the GTree APIs which did not immediately release the memory back to the system allocator. As a result QEMU's use-after-free bug was not visible. With GLib > 2.75.3 however, GLib2 has switched to using malloc and now a SIGSEGV can be observed while running test-vmstate. Get rid of the node removal within the tree traversal. Also check the trees have the same number of nodes before the actual diff. Fixes: 9a85e4b8f6 ("migration: Support gtree migration") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518 Signed-off-by: Marc-André Lureau Signed-off-by: Eric Auger Reported-by: Richard W.M. Jones Tested-by: Richard W.M. Jones Reviewed-by: Richard W.M. Jones Reviewed-by: Daniel P. Berrangé Reviewed-by: Juan Quintela Signed-off-by: Juan Quintela (cherry picked from commit abe2c4bdb65e8dd9cb2f01c355baa394bf49a8af) Signed-off-by: Michael Tokarev --- diff --git a/tests/unit/test-vmstate.c b/tests/unit/test-vmstate.c index 541bb4f63e3..aae32bbf913 100644 --- a/tests/unit/test-vmstate.c +++ b/tests/unit/test-vmstate.c @@ -1074,7 +1074,6 @@ static gboolean diff_tree(gpointer key, gpointer value, gpointer data) struct match_node_data d = {tp->tree2, key, value}; g_tree_foreach(tp->tree2, tp->match_node, &d); - g_tree_remove(tp->tree1, key); return false; } @@ -1083,9 +1082,9 @@ static void compare_trees(GTree *tree1, GTree *tree2, { struct tree_cmp_data tp = {tree1, tree2, function}; + assert(g_tree_nnodes(tree1) == g_tree_nnodes(tree2)); g_tree_foreach(tree1, diff_tree, &tp); - assert(g_tree_nnodes(tree1) == 0); - assert(g_tree_nnodes(tree2) == 0); + g_tree_destroy(g_tree_ref(tree1)); } static void diff_domain(TestGTreeDomain *d1, TestGTreeDomain *d2)