Am 01.06.26 um 2:16 PM schrieb Dominik Csapak: > to prevent a use after free on a client struct, instead of freeing it > inline in 'cleanup_client', only set a boolean flag 'pending_free' > and free it in the main 'handle_client' function. > > the call graphs look like this: > > handle_client > `-> cleanup_client > `-> handle_qmp_handshake > `-> cleanup_client > `-> send_qmp_cmd > `-> cleanup_client > `-> handle_qmp_event > `-> terminate_check
Nit: there's an additional `-> send_qmp_cmd here (terminate_check() does not call cleanup_client() directly). > `-> cleanup_client > `-> handle_qmp_return > `-> terminate_check Nit: same here > `-> cleanup_client > > In addition, if we cleanup a 'vzdump' client, the corresponding vm wll s/vm wll/VM client will/ > be looked up and 'terminate_check' will be called for it. If that > resulted in a cleanup, we have to free that immediately. > > cleanup_client will not be called in other paths, so handling the > freeing in handle_client should suffice. > > Signed-off-by: Dominik Csapak <[email protected]> Reviewed-by: Fiona Ebner <[email protected]> Thanks!
