From 89471ef237ca683c90e9e8d216746b86ba4c1013 Mon Sep 17 00:00:00 2001 From: Peter Xu Date: Tue, 21 Oct 2025 18:04:06 -0400 Subject: [PATCH] migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails Per reported and analyzed by Peter: https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com Fix the issue by moving the error_setg_errno() earlier. When at it, clear argv variable after freed. Resolves: Coverity CID 1641397 Fixes: a3eae205c6 ("migration: cpr-exec mode") Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/r/20251021220407.2662288-4-peterx@redhat.com Signed-off-by: Peter Xu --- migration/cpr-exec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c index 087ca94c87..d284f6e734 100644 --- a/migration/cpr-exec.c +++ b/migration/cpr-exec.c @@ -152,10 +152,10 @@ static void cpr_exec_cb(void *opaque) * exec should only fail if argv[0] is bogus, or has a permissions problem, * or the system is very short on resources. */ - g_strfreev(argv); + error_setg_errno(&err, errno, "execvp %s failed", argv[0]); + g_clear_pointer(&argv, g_strfreev); cpr_exec_unpreserve_fds(); - error_setg_errno(&err, errno, "execvp %s failed", argv[0]); error_report_err(error_copy(err)); migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED); migrate_set_error(s, err); -- 2.47.3