Re: [PATCH v2] io: remove io watch if TLS channel is closed during handshake

[Michael Tokarev]

12.07.2023 19:55, Daniel P. Berrangé wrote:
> The TLS handshake make take some time to complete, during which time an
> I/O watch might be registered with the main loop. If the owner of the
> I/O channel invokes qio_channel_close() while the handshake is waiting
> to continue the I/O watch must be removed. Failing to remove it will
> later trigger the completion callback which the owner is not expecting
> to receive. In the case of the VNC server, this results in a SEGV as
> vnc_disconnect_start() tries to shutdown a client connection that is
> already gone / NULL.
>
> CVE-2023-3354
> Reported-by: jiangyegen <jiangyegen@huawei.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>
> In v2:
>
>   - Use g_clear_handle_id to set source ID to zero
>
>   include/io/channel-tls.h |  1 +
>   io/channel-tls.c         | 18 ++++++++++++------
>   2 files changed, 13 insertions(+), 6 deletions(-)

I can't say I completely understand what's going on here,
but I tried to understand it.  And it looks like the patch
is doing the right thing.  Dunno if I can add my

Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

Thank you for the good work Daniel!

/mjt