From: Akihiko Odaki <akihiko.odaki@xxxxxxxxxx>
execlog had the following comment:
> As we could have multiple threads trying to do this we need to
> serialise the expansion under a lock. Threads accessing already
> created entries can continue without issue even if the ptr array
> gets reallocated during resize.
However, when the ptr array gets reallocated, the other threads may have
a stale reference to the old buffer. This results in use-after-free.
Use GRWLock to properly fix this issue.
Fixes: 3d7caf145e ("contrib/plugins: add execlog to log instruction execution and memory access")
Signed-off-by: Akihiko Odaki <akihiko.odaki@xxxxxxxxxx>
Reviewed-by: Alex Bennée <alex.bennee@xxxxxxxxxx>
Message-Id: <20230912224107.29669-5-akihiko.odaki@xxxxxxxxxx>
Signed-off-by: Alex Bennée <alex.bennee@xxxxxxxxxx>
---
contrib/plugins/execlog.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index 7129d526f8..82dc2f584e 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -19,7 +19,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
/* Store last executed instruction on each vCPU as a GString */
static GPtrArray *last_exec;
-static GMutex expand_array_lock;
+static GRWLock expand_array_lock;
static GPtrArray *imatches;
static GArray *amatches;
@@ -28,18 +28,16 @@ static GArray *amatches;
* Expand last_exec array.
*
* As we could have multiple threads trying to do this we need to
- * serialise the expansion under a lock. Threads accessing already
- * created entries can continue without issue even if the ptr array
- * gets reallocated during resize.
+ * serialise the expansion under a lock.
*/
static void expand_last_exec(int cpu_index)
{
- g_mutex_lock(&expand_array_lock);
+ g_rw_lock_writer_lock(&expand_array_lock);
while (cpu_index >= last_exec->len) {
GString *s = g_string_new(NULL);
g_ptr_array_add(last_exec, s);
}
- g_mutex_unlock(&expand_array_lock);
+ g_rw_lock_writer_unlock(&expand_array_lock);
}
/**
@@ -51,8 +49,10 @@ static void vcpu_mem(unsigned int cpu_index, qemu_plugin_meminfo_t info,
GString *s;
/* Find vCPU in array */
+ g_rw_lock_reader_lock(&expand_array_lock);
g_assert(cpu_index < last_exec->len);
s = g_ptr_array_index(last_exec, cpu_index);
+ g_rw_lock_reader_unlock(&expand_array_lock);
/* Indicate type of memory access */
if (qemu_plugin_mem_is_store(info)) {
@@ -80,10 +80,14 @@ static void vcpu_insn_exec(unsigned int cpu_index, void *udata)
GString *s;
/* Find or create vCPU in array */
+ g_rw_lock_reader_lock(&expand_array_lock);
if (cpu_index >= last_exec->len) {
+ g_rw_lock_reader_unlock(&expand_array_lock);
expand_last_exec(cpu_index);
+ g_rw_lock_reader_lock(&expand_array_lock);
}
s = g_ptr_array_index(last_exec, cpu_index);
+ g_rw_lock_reader_unlock(&expand_array_lock);
/* Print previous instruction in cache */
if (s->len) {
--
2.39.2
