From: Greg Kurz <groug@kaod.org> To: qemu-devel@nongnu.org Cc: "Daniel P . Berrangé" <berrange@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, "Greg Kurz" <groug@kaod.org>, virtio-fs@redhat.com, "Stefan Hajnoczi" <stefanha@redhat.com>, "Vivek Goyal" <vgoyal@redhat.com> Subject: [PATCH v2 2/7] vhost-user: Fix double-close on slave_read() error path Date: Fri, 12 Mar 2021 10:22:07 +0100 [thread overview] Message-ID: <20210312092212.782255-3-groug@kaod.org> (raw) In-Reply-To: <20210312092212.782255-1-groug@kaod.org> Some message types, e.g. VHOST_USER_SLAVE_VRING_HOST_NOTIFIER_MSG, can convey file descriptors. These must be closed before returning from slave_read() to avoid being leaked. This can currently be done in two different places: [1] just after the request has been processed [2] on the error path, under the goto label err: These path are supposed to be mutually exclusive but they are not actually. If the VHOST_USER_NEED_REPLY_MASK flag was passed and the sending of the reply fails, both [1] and [2] are performed with the same descriptor values. This can potentially cause subtle bugs if one of the descriptor was recycled by some other thread in the meantime. This code duplication complicates rollback for no real good benefit. Do the closing in a unique place, under a new fdcleanup: goto label at the end of the function. Signed-off-by: Greg Kurz <groug@kaod.org> --- hw/virtio/vhost-user.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 6af9b43a7232..acde1d293684 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1475,13 +1475,6 @@ static void slave_read(void *opaque) ret = -EINVAL; } - /* Close the remaining file descriptors. */ - for (i = 0; i < fdsize; i++) { - if (fd[i] != -1) { - close(fd[i]); - } - } - /* * REPLY_ACK feature handling. Other reply types has to be managed * directly in their request handlers. @@ -1511,12 +1504,14 @@ static void slave_read(void *opaque) } } - return; + goto fdcleanup; err: qemu_set_fd_handler(u->slave_fd, NULL, NULL, NULL); close(u->slave_fd); u->slave_fd = -1; + +fdcleanup: for (i = 0; i < fdsize; i++) { if (fd[i] != -1) { close(fd[i]); -- 2.26.2
WARNING: multiple messages have this Message-ID (diff)
From: Greg Kurz <groug@kaod.org> To: qemu-devel@nongnu.org Cc: "Daniel P . Berrangé" <berrange@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, virtio-fs@redhat.com, "Vivek Goyal" <vgoyal@redhat.com> Subject: [Virtio-fs] [PATCH v2 2/7] vhost-user: Fix double-close on slave_read() error path Date: Fri, 12 Mar 2021 10:22:07 +0100 [thread overview] Message-ID: <20210312092212.782255-3-groug@kaod.org> (raw) In-Reply-To: <20210312092212.782255-1-groug@kaod.org> Some message types, e.g. VHOST_USER_SLAVE_VRING_HOST_NOTIFIER_MSG, can convey file descriptors. These must be closed before returning from slave_read() to avoid being leaked. This can currently be done in two different places: [1] just after the request has been processed [2] on the error path, under the goto label err: These path are supposed to be mutually exclusive but they are not actually. If the VHOST_USER_NEED_REPLY_MASK flag was passed and the sending of the reply fails, both [1] and [2] are performed with the same descriptor values. This can potentially cause subtle bugs if one of the descriptor was recycled by some other thread in the meantime. This code duplication complicates rollback for no real good benefit. Do the closing in a unique place, under a new fdcleanup: goto label at the end of the function. Signed-off-by: Greg Kurz <groug@kaod.org> --- hw/virtio/vhost-user.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 6af9b43a7232..acde1d293684 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -1475,13 +1475,6 @@ static void slave_read(void *opaque) ret = -EINVAL; } - /* Close the remaining file descriptors. */ - for (i = 0; i < fdsize; i++) { - if (fd[i] != -1) { - close(fd[i]); - } - } - /* * REPLY_ACK feature handling. Other reply types has to be managed * directly in their request handlers. @@ -1511,12 +1504,14 @@ static void slave_read(void *opaque) } } - return; + goto fdcleanup; err: qemu_set_fd_handler(u->slave_fd, NULL, NULL, NULL); close(u->slave_fd); u->slave_fd = -1; + +fdcleanup: for (i = 0; i < fdsize; i++) { if (fd[i] != -1) { close(fd[i]); -- 2.26.2
next prev parent reply other threads:[~2021-03-12 9:25 UTC|newest] Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-03-12 9:22 [PATCH v2 0/7] virtiofsd: Avoid potential deadlocks Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-12 9:22 ` [PATCH v2 1/7] vhost-user: Drop misleading EAGAIN checks in slave_read() Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 10:34 ` Stefan Hajnoczi 2021-03-15 10:34 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` Greg Kurz [this message] 2021-03-12 9:22 ` [Virtio-fs] [PATCH v2 2/7] vhost-user: Fix double-close on slave_read() error path Greg Kurz 2021-03-15 10:36 ` Stefan Hajnoczi 2021-03-15 10:36 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` [PATCH v2 3/7] vhost-user: Factor out duplicated slave_fd teardown code Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 10:36 ` Stefan Hajnoczi 2021-03-15 10:36 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` [PATCH v2 4/7] vhost-user: Convert slave channel to QIOChannelSocket Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 10:37 ` Stefan Hajnoczi 2021-03-15 10:37 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` [PATCH v2 5/7] vhost-user: Introduce nested event loop in vhost_user_read() Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 10:38 ` Stefan Hajnoczi 2021-03-15 10:38 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` [PATCH v2 6/7] vhost-user: Monitor slave channel " Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 12:20 ` Stefan Hajnoczi 2021-03-15 12:20 ` [Virtio-fs] " Stefan Hajnoczi 2021-03-12 9:22 ` [PATCH v2 7/7] virtiofsd: Release vu_dispatch_lock when stopping queue Greg Kurz 2021-03-12 9:22 ` [Virtio-fs] " Greg Kurz 2021-03-15 14:57 ` Dr. David Alan Gilbert 2021-03-15 14:57 ` [Virtio-fs] " Dr. David Alan Gilbert
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210312092212.782255-3-groug@kaod.org \ --to=groug@kaod.org \ --cc=berrange@redhat.com \ --cc=dgilbert@redhat.com \ --cc=mst@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=stefanha@redhat.com \ --cc=vgoyal@redhat.com \ --cc=virtio-fs@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.