| Message ID | 20210319204124.364312-1-vsementsov@virtuozzo.com |
|---|---|
| Headers | show |
| Series | Fix crash if try to remove bitmap on target during migration | expand |
On Fri, Mar 19, 2021 at 11:41:22PM +0300, Vladimir Sementsov-Ogievskiy wrote: > Hi all! > > Bitmaps on source are marked busy during migration. > > Enabled bitmaps on target have successor, so they are busy. > > But disabled migrated bitmaps are not protected on target. User can > simple remove them and it lead to use-after-free. These bitmaps should > be marked busy. > > Vladimir Sementsov-Ogievskiy (2): > migration/block-dirty-bitmap: make incoming disabled bitmaps busy > migrate-bitmaps-postcopy-test: check that we can't remove in-flight > bitmaps > > migration/block-dirty-bitmap.c | 6 ++++++ > tests/qemu-iotests/tests/migrate-bitmaps-postcopy-test | 9 +++++++++ > 2 files changed, 15 insertions(+) > > -- > 2.29.2 > Thanks, applied to my block tree: https://gitlab.com/stefanha/qemu/commits/block Stefan
22.03.2021 14:28, Stefan Hajnoczi wrote: > On Fri, Mar 19, 2021 at 11:41:22PM +0300, Vladimir Sementsov-Ogievskiy wrote: >> Hi all! >> >> Bitmaps on source are marked busy during migration. >> >> Enabled bitmaps on target have successor, so they are busy. >> >> But disabled migrated bitmaps are not protected on target. User can >> simple remove them and it lead to use-after-free. These bitmaps should >> be marked busy. >> >> Vladimir Sementsov-Ogievskiy (2): >> migration/block-dirty-bitmap: make incoming disabled bitmaps busy >> migrate-bitmaps-postcopy-test: check that we can't remove in-flight >> bitmaps >> >> migration/block-dirty-bitmap.c | 6 ++++++ >> tests/qemu-iotests/tests/migrate-bitmaps-postcopy-test | 9 +++++++++ >> 2 files changed, 15 insertions(+) >> >> -- >> 2.29.2 >> > > Thanks, applied to my block tree: > https://gitlab.com/stefanha/qemu/commits/block > > Stefan > Thanks! O_o. Somehow, I've sent this thing twice, look at "[PATCH for-6.0 0/2] Fix use-after-free, if remove bitmap during migration". Sorry for the mess :\ patch 1 is the same, but patch 2 in new submission is updated to check that bitmaps can't be removed on source too. If it doesn't bother you can update the patch 2 in your branch too.
Hi all! Bitmaps on source are marked busy during migration. Enabled bitmaps on target have successor, so they are busy. But disabled migrated bitmaps are not protected on target. User can simple remove them and it lead to use-after-free. These bitmaps should be marked busy. Vladimir Sementsov-Ogievskiy (2): migration/block-dirty-bitmap: make incoming disabled bitmaps busy migrate-bitmaps-postcopy-test: check that we can't remove in-flight bitmaps migration/block-dirty-bitmap.c | 6 ++++++ tests/qemu-iotests/tests/migrate-bitmaps-postcopy-test | 9 +++++++++ 2 files changed, 15 insertions(+)