From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 7FB931FF0AB for ; Mon, 07 Sep 2026 11:49:11 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 0495D216E1; Mon, 07 Sep 2026 11:48:03 +0200 (CEST) From: Erik Fastermann To: pve-devel@lists.proxmox.com Subject: [PATCH qemu v2 4/9] migration/pbs-state: check allocation of incoming state buffer Date: Mon, 7 Sep 2026 11:47:38 +0200 Message-ID: <20260907094744.131193-5-e.fastermann@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260907094744.131193-1-e.fastermann@proxmox.com> References: <20260907094744.131193-1-e.fastermann@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 1 AWL -0.495 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: ABEXZX7LWNOT4LLHLWCXEPSNJVII5P3A X-Message-ID-Hash: ABEXZX7LWNOT4LLHLWCXEPSNJVII5P3A X-MailFrom: efastermann@ruth.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Erik Fastermann X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The length is read from the migration stream, so it cannot be trusted. An unchecked malloc() means a corrupt or truncated state file makes qemu_get_buffer() write through a NULL pointer. Also the short read path returned without freeing the buffer. Signed-off-by: Erik Fastermann --- ...igrate-dirty-bitmap-state-via-savevm.patch | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch b/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch index adb41f4..4ce1d8c 100644 --- a/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch +++ b/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch @@ -15,14 +15,16 @@ Signed-off-by: Stefan Reiter Signed-off-by: Thomas Lamprecht [FE: split up state_pending for 8.0] Signed-off-by: Fiona Ebner +[EF: check allocation of incoming state buffer] +Signed-off-by: Erik Fastermann --- include/migration/misc.h | 3 ++ migration/meson.build | 2 + migration/migration.c | 1 + - migration/pbs-state.c | 104 +++++++++++++++++++++++++++++++++++++++ + migration/pbs-state.c | 111 +++++++++++++++++++++++++++++++++++++++ pve-backup.c | 1 + qapi/block-core.json | 6 +++ - 6 files changed, 117 insertions(+) + 6 files changed, 124 insertions(+) create mode 100644 migration/pbs-state.c diff --git a/include/migration/misc.h b/include/migration/misc.h @@ -71,10 +73,10 @@ index dfc60372cf..f415448689 100644 typedef struct { diff --git a/migration/pbs-state.c b/migration/pbs-state.c new file mode 100644 -index 0000000000..a97187e4d7 +index 0000000000..c0c7f2ff6f --- /dev/null +++ b/migration/pbs-state.c -@@ -0,0 +1,104 @@ +@@ -0,0 +1,111 @@ +/* + * PBS (dirty-bitmap) state migration + */ @@ -104,18 +106,25 @@ index 0000000000..a97187e4d7 +{ + /* safe cast, we cannot migrate to target with less bits than source */ + size_t buf_size = (size_t)qemu_get_be64(f); ++ if (buf_size == 0) { ++ return 0; ++ } + -+ uint8_t *buf = (uint8_t *)malloc(buf_size); -+ size_t read = qemu_get_buffer(f, buf, buf_size); ++ g_autofree uint8_t *buf = g_try_malloc(buf_size); ++ if (!buf) { ++ fprintf(stderr, ++ "error receiving PBS state: cannot allocate %zu bytes\n", ++ buf_size); ++ return -ENOMEM; ++ } + ++ size_t read = qemu_get_buffer(f, buf, buf_size); + if (read < buf_size) { + fprintf(stderr, "error receiving PBS state: not enough data\n"); + return -EIO; + } + + proxmox_import_state(buf, buf_size); -+ -+ free(buf); + return 0; +} + -- 2.47.3