Re: [PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-22 Thread Peter Xu
On Mon, Jan 22, 2024 at 01:55:45PM -0300, Fabiano Rosas wrote: > Peter Xu writes: > > > On Mon, Jan 22, 2024 at 05:49:01PM +0800, Peter Xu wrote: > >> On Fri, Jan 19, 2024 at 08:39:18PM -0300, Fabiano Rosas wrote: > >> > We're currently allowing the process_incoming_migration_bh bottom-half > >>

Re: [PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-22 Thread Fabiano Rosas
Peter Xu writes: > On Mon, Jan 22, 2024 at 05:49:01PM +0800, Peter Xu wrote: >> On Fri, Jan 19, 2024 at 08:39:18PM -0300, Fabiano Rosas wrote: >> > We're currently allowing the process_incoming_migration_bh bottom-half >> > to run without holding a reference to the 'current_migration' object, >>

Re: [PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-22 Thread Peter Xu
On Mon, Jan 22, 2024 at 05:49:01PM +0800, Peter Xu wrote: > On Fri, Jan 19, 2024 at 08:39:18PM -0300, Fabiano Rosas wrote: > > We're currently allowing the process_incoming_migration_bh bottom-half > > to run without holding a reference to the 'current_migration' object, > > which leads to a

Re: [PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-22 Thread Peter Xu
On Fri, Jan 19, 2024 at 08:39:18PM -0300, Fabiano Rosas wrote: > We're currently allowing the process_incoming_migration_bh bottom-half > to run without holding a reference to the 'current_migration' object, > which leads to a segmentation fault if the BH is still live after > migration_shutdown()

Re: [PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-19 Thread Fabiano Rosas
Fabiano Rosas writes: > We're currently allowing the process_incoming_migration_bh bottom-half > to run without holding a reference to the 'current_migration' object, > which leads to a segmentation fault if the BH is still live after > migration_shutdown() has dropped the last reference to >

[PATCH 1/5] migration: Fix use-after-free of migration state object

2024-01-19 Thread Fabiano Rosas
We're currently allowing the process_incoming_migration_bh bottom-half to run without holding a reference to the 'current_migration' object, which leads to a segmentation fault if the BH is still live after migration_shutdown() has dropped the last reference to current_migration. In my system the