Re: [PATCH qemu-server] fix #7654: prevent use after free

[Fiona Ebner <f.ebner@proxmox.com>]

Am 01.06.26 um 2:16 PM schrieb Dominik Csapak:
> to prevent a use after free on a client struct, instead of freeing it
> inline in 'cleanup_client', only set a boolean flag 'pending_free'
> and free it in the main 'handle_client' function.
> 
> the call graphs look like this:
> 
> handle_client
> `-> cleanup_client
> `-> handle_qmp_handshake
>     `-> cleanup_client
>     `-> send_qmp_cmd
>         `-> cleanup_client
> `-> handle_qmp_event
>     `-> terminate_check

Nit: there's an additional `-> send_qmp_cmd here (terminate_check() does
not call cleanup_client() directly).

>         `-> cleanup_client
> `-> handle_qmp_return
>     `-> terminate_check

Nit: same here

>         `-> cleanup_client
> 
> In addition, if we cleanup a 'vzdump' client, the corresponding vm wll

s/vm wll/VM client will/

> be looked up and 'terminate_check' will be called for it. If that
> resulted in a cleanup, we have to free that immediately.
> 
> cleanup_client will not be called in other paths, so handling the
> freeing in handle_client should suffice.
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>

Thanks!