Re: [PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Peter Xu
On Thu, Feb 20, 2025 at 03:48:17PM +0100, Juraj Marcin wrote: > Maybe it could be also useful to add assertions to places where locked > BQL is assumed and the assumption is not clear enough. Then, when > something changes, it will fail with a clear reason instead of debugging > race conditions tha

Re: [PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Juraj Marcin
On 2025-02-20 11:06, Fabiano Rosas wrote: > Peter Xu writes: > > > On the incoming migration side, QEMU uses a coroutine to load all the VM > > states. Inside, it may reference MigrationState on global states like > > migration capabilities, parameters, error state, shared mutexes and more. > >

Re: [PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Fabiano Rosas
Peter Xu writes: > On Thu, Feb 20, 2025 at 11:06:12AM -0300, Fabiano Rosas wrote: >> Peter Xu writes: >> >> > On the incoming migration side, QEMU uses a coroutine to load all the VM >> > states. Inside, it may reference MigrationState on global states like >> > migration capabilities, paramet

Re: [PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Peter Xu
On Thu, Feb 20, 2025 at 11:06:12AM -0300, Fabiano Rosas wrote: > Peter Xu writes: > > > On the incoming migration side, QEMU uses a coroutine to load all the VM > > states. Inside, it may reference MigrationState on global states like > > migration capabilities, parameters, error state, shared m

Re: [PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Fabiano Rosas
Peter Xu writes: > On the incoming migration side, QEMU uses a coroutine to load all the VM > states. Inside, it may reference MigrationState on global states like > migration capabilities, parameters, error state, shared mutexes and more. > > However there's nothing yet to make sure MigrationSt

[PATCH] migration: Fix UAF for incoming migration on MigrationState

2025-02-20 Thread Peter Xu
On the incoming migration side, QEMU uses a coroutine to load all the VM states. Inside, it may reference MigrationState on global states like migration capabilities, parameters, error state, shared mutexes and more. However there's nothing yet to make sure MigrationState won't get destroyed (e.g