test-vmstate: fix bad GTree usage, use-after-free
commitabe2c4bdb65e8dd9cb2f01c355baa394bf49a8af
authorEric Auger <eric.auger@redhat.com>
Tue, 28 Feb 2023 09:29:44 +0000 (28 10:29 +0100)
committerJuan Quintela <quintela@redhat.com>
Thu, 2 Mar 2023 16:06:27 +0000 (2 17:06 +0100)
treefbe1a6e825100b50ddb2d25b0cd123d7dc6d04dc
parent262312d7ba6e2966acedb4f9c134fd19176b4083
test-vmstate: fix bad GTree usage, use-after-free

According to g_tree_foreach() documentation:
"The tree may not be modified while iterating over it (you can't
add/remove items)."

compare_trees()/diff_tree() fail to respect this rule.
Historically GLib2 used a slice allocator for the GTree APIs
which did not immediately release the memory back to the system
allocator. As a result QEMU's use-after-free bug was not visible.
With GLib > 2.75.3 however, GLib2 has switched to using malloc
and now a SIGSEGV can be observed while running test-vmstate.

Get rid of the node removal within the tree traversal. Also
check the trees have the same number of nodes before the actual
diff.

Fixes: 9a85e4b8f6 ("migration: Support gtree migration")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1518
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
tests/unit/test-vmstate.c