* [PULL 0/1] NBD fix for 6.0-rc3
@ 2021-04-12 12:18 Vladimir Sementsov-Ogievskiy
2021-04-12 12:18 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Vladimir Sementsov-Ogievskiy
2021-04-12 15:48 ` [PULL 0/1] NBD fix for 6.0-rc3 Peter Maydell
0 siblings, 2 replies; 5+ messages in thread
From: Vladimir Sementsov-Ogievskiy @ 2021-04-12 12:18 UTC (permalink / raw)
To: qemu-block; +Cc: qemu-devel, eblake, vsementsov, peter.maydell, rvkagan
The following changes since commit 555249a59e9cdd6b58da103aba5cf3a2d45c899f:
Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-04-10 16:58:56 +0100)
are available in the Git repository at:
https://src.openvz.org/scm/~vsementsov/qemu.git tags/pull-nbd-2021-04-12
for you to fetch changes up to d3c278b689845558cd9811940436b28ae6afc5d7:
block/nbd: fix possible use after free of s->connect_thread (2021-04-12 11:56:03 +0300)
----------------------------------------------------------------
One fix of possible use-after-free in NBD block-driver for 6.0-rc3
----------------------------------------------------------------
Note: the tag is signed by a new key, as I've lost the old one. So,
now there are two keys with my name on http://keys.gnupg.net, the elder
is lost. I feel stupid about that :(. Anyway, both keys are not signed by
anybody except for myself. And this is my first pull-request to Qemu,
so, I think some kind of TOFU still applies.
Vladimir Sementsov-Ogievskiy (1):
block/nbd: fix possible use after free of s->connect_thread
block/nbd.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--
2.29.2
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread
2021-04-12 12:18 [PULL 0/1] NBD fix for 6.0-rc3 Vladimir Sementsov-Ogievskiy
@ 2021-04-12 12:18 ` Vladimir Sementsov-Ogievskiy
2021-04-12 15:48 ` [PULL 0/1] NBD fix for 6.0-rc3 Peter Maydell
1 sibling, 0 replies; 5+ messages in thread
From: Vladimir Sementsov-Ogievskiy @ 2021-04-12 12:18 UTC (permalink / raw)
To: qemu-block; +Cc: qemu-devel, eblake, vsementsov, peter.maydell, rvkagan
If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.
Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.
Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.
After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
---
block/nbd.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/block/nbd.c b/block/nbd.c
index c26dc5a54f..1d4668d42d 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -443,6 +443,11 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
BDRVNBDState *s = bs->opaque;
NBDConnectThread *thr = s->connect_thread;
+ if (!thr) {
+ /* detached */
+ return -1;
+ }
+
qemu_mutex_lock(&thr->mutex);
switch (thr->state) {
@@ -486,6 +491,12 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
s->wait_connect = true;
qemu_coroutine_yield();
+ if (!s->connect_thread) {
+ /* detached */
+ return -1;
+ }
+ assert(thr == s->connect_thread);
+
qemu_mutex_lock(&thr->mutex);
switch (thr->state) {
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PULL 0/1] NBD fix for 6.0-rc3
2021-04-12 12:18 [PULL 0/1] NBD fix for 6.0-rc3 Vladimir Sementsov-Ogievskiy
2021-04-12 12:18 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Vladimir Sementsov-Ogievskiy
@ 2021-04-12 15:48 ` Peter Maydell
2021-04-13 6:47 ` Vladimir Sementsov-Ogievskiy
1 sibling, 1 reply; 5+ messages in thread
From: Peter Maydell @ 2021-04-12 15:48 UTC (permalink / raw)
To: Vladimir Sementsov-Ogievskiy; +Cc: rvkagan, QEMU Developers, Qemu-block
On Mon, 12 Apr 2021 at 13:19, Vladimir Sementsov-Ogievskiy
<vsementsov@virtuozzo.com> wrote:
>
> The following changes since commit 555249a59e9cdd6b58da103aba5cf3a2d45c899f:
>
> Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-04-10 16:58:56 +0100)
>
> are available in the Git repository at:
>
> https://src.openvz.org/scm/~vsementsov/qemu.git tags/pull-nbd-2021-04-12
>
> for you to fetch changes up to d3c278b689845558cd9811940436b28ae6afc5d7:
>
> block/nbd: fix possible use after free of s->connect_thread (2021-04-12 11:56:03 +0300)
>
> ----------------------------------------------------------------
> One fix of possible use-after-free in NBD block-driver for 6.0-rc3
>
> ----------------------------------------------------------------
>
> Note: the tag is signed by a new key, as I've lost the old one. So,
> now there are two keys with my name on http://keys.gnupg.net, the elder
> is lost. I feel stupid about that :(. Anyway, both keys are not signed by
> anybody except for myself. And this is my first pull-request to Qemu,
> so, I think some kind of TOFU still applies.
I'd really rather not deal with trying to add a new source of pull
requests the day before rc3, please. Eric, could you do a pull
or something?
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PULL 0/1] NBD fix for 6.0-rc3
2021-04-12 15:48 ` [PULL 0/1] NBD fix for 6.0-rc3 Peter Maydell
@ 2021-04-13 6:47 ` Vladimir Sementsov-Ogievskiy
2021-04-13 10:22 ` Peter Maydell
0 siblings, 1 reply; 5+ messages in thread
From: Vladimir Sementsov-Ogievskiy @ 2021-04-13 6:47 UTC (permalink / raw)
To: Peter Maydell
Cc: Qemu-block, QEMU Developers, Eric Blake, rvkagan, Max Reitz, Kevin Wolf
12.04.2021 18:48, Peter Maydell wrote:
> On Mon, 12 Apr 2021 at 13:19, Vladimir Sementsov-Ogievskiy
> <vsementsov@virtuozzo.com> wrote:
>>
>> The following changes since commit 555249a59e9cdd6b58da103aba5cf3a2d45c899f:
>>
>> Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-04-10 16:58:56 +0100)
>>
>> are available in the Git repository at:
>>
>> https://src.openvz.org/scm/~vsementsov/qemu.git tags/pull-nbd-2021-04-12
>>
>> for you to fetch changes up to d3c278b689845558cd9811940436b28ae6afc5d7:
>>
>> block/nbd: fix possible use after free of s->connect_thread (2021-04-12 11:56:03 +0300)
>>
>> ----------------------------------------------------------------
>> One fix of possible use-after-free in NBD block-driver for 6.0-rc3
>>
>> ----------------------------------------------------------------
>>
>> Note: the tag is signed by a new key, as I've lost the old one. So,
>> now there are two keys with my name on http://keys.gnupg.net, the elder
>> is lost. I feel stupid about that :(. Anyway, both keys are not signed by
>> anybody except for myself. And this is my first pull-request to Qemu,
>> so, I think some kind of TOFU still applies.
>
> I'd really rather not deal with trying to add a new source of pull
> requests the day before rc3, please. Eric, could you do a pull
> or something?
>
> thanks
> -- PMM
>
Hmm. Ok, that's not a degradation of 6.0 and there is no existing bug somewhere, so we can just not care for 6.0.
--
Best regards,
Vladimir
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PULL 0/1] NBD fix for 6.0-rc3
2021-04-13 6:47 ` Vladimir Sementsov-Ogievskiy
@ 2021-04-13 10:22 ` Peter Maydell
0 siblings, 0 replies; 5+ messages in thread
From: Peter Maydell @ 2021-04-13 10:22 UTC (permalink / raw)
To: Vladimir Sementsov-Ogievskiy
Cc: Kevin Wolf, Qemu-block, QEMU Developers, Max Reitz, rvkagan
On Tue, 13 Apr 2021 at 07:47, Vladimir Sementsov-Ogievskiy
<vsementsov@virtuozzo.com> wrote:
>
> 12.04.2021 18:48, Peter Maydell wrote:
> > On Mon, 12 Apr 2021 at 13:19, Vladimir Sementsov-Ogievskiy
> > <vsementsov@virtuozzo.com> wrote:
> >>
> >> The following changes since commit 555249a59e9cdd6b58da103aba5cf3a2d45c899f:
> >>
> >> Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-04-10 16:58:56 +0100)
> >>
> >> are available in the Git repository at:
> >>
> >> https://src.openvz.org/scm/~vsementsov/qemu.git tags/pull-nbd-2021-04-12
> >>
> >> for you to fetch changes up to d3c278b689845558cd9811940436b28ae6afc5d7:
> >>
> >> block/nbd: fix possible use after free of s->connect_thread (2021-04-12 11:56:03 +0300)
> >>
> >> ----------------------------------------------------------------
> >> One fix of possible use-after-free in NBD block-driver for 6.0-rc3
> >>
> >> ----------------------------------------------------------------
> >>
> >> Note: the tag is signed by a new key, as I've lost the old one. So,
> >> now there are two keys with my name on http://keys.gnupg.net, the elder
> >> is lost. I feel stupid about that :(. Anyway, both keys are not signed by
> >> anybody except for myself. And this is my first pull-request to Qemu,
> >> so, I think some kind of TOFU still applies.
> >
> > I'd really rather not deal with trying to add a new source of pull
> > requests the day before rc3, please. Eric, could you do a pull
> > or something?
> Hmm. Ok, that's not a degradation of 6.0 and there is no existing bug
> somewhere, so we can just not care for 6.0.
I think fixing a use-after-free is sensible for rc3; it's only having
it come to me via a new unknown submitter of pull requests that I'm
not happy about.
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-04-13 10:25 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-12 12:18 [PULL 0/1] NBD fix for 6.0-rc3 Vladimir Sementsov-Ogievskiy
2021-04-12 12:18 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Vladimir Sementsov-Ogievskiy
2021-04-12 15:48 ` [PULL 0/1] NBD fix for 6.0-rc3 Peter Maydell
2021-04-13 6:47 ` Vladimir Sementsov-Ogievskiy
2021-04-13 10:22 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.