qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [PULL 0/1] Block patch for 6.0-rc3
@ 2021-04-13 13:39 Max Reitz
  2021-04-13 13:39 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Max Reitz
  2021-04-13 21:11 ` [PULL 0/1] Block patch for 6.0-rc3 Peter Maydell
  0 siblings, 2 replies; 3+ messages in thread
From: Max Reitz @ 2021-04-13 13:39 UTC (permalink / raw)
  To: qemu-block
  Cc: Kevin Wolf, Peter Maydell, Vladimir Sementsov-Ogievskiy,
	qemu-devel, Max Reitz

The following changes since commit dce628a97fde2594f99d738883a157f05aa0a14f:

  Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' into staging (2021-04-13 13:05:07 +0100)

are available in the Git repository at:

  https://github.com/XanClic/qemu.git tags/pull-block-2021-04-13

for you to fetch changes up to 0267101af64292c9a84fd9319a763ddfbce9ddc7:

  block/nbd: fix possible use after free of s->connect_thread (2021-04-13 15:35:12 +0200)

(This is the patch for which Vladimir has sent a pull request yesterday.)

----------------------------------------------------------------
Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c

----------------------------------------------------------------
Vladimir Sementsov-Ogievskiy (1):
  block/nbd: fix possible use after free of s->connect_thread

 block/nbd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

-- 
2.29.2



^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread
  2021-04-13 13:39 [PULL 0/1] Block patch for 6.0-rc3 Max Reitz
@ 2021-04-13 13:39 ` Max Reitz
  2021-04-13 21:11 ` [PULL 0/1] Block patch for 6.0-rc3 Peter Maydell
  1 sibling, 0 replies; 3+ messages in thread
From: Max Reitz @ 2021-04-13 13:39 UTC (permalink / raw)
  To: qemu-block
  Cc: Kevin Wolf, Peter Maydell, Vladimir Sementsov-Ogievskiy,
	qemu-devel, Max Reitz

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.

Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.

Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.

After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/nbd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/block/nbd.c b/block/nbd.c
index c26dc5a54f..1d4668d42d 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -443,6 +443,11 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
     BDRVNBDState *s = bs->opaque;
     NBDConnectThread *thr = s->connect_thread;
 
+    if (!thr) {
+        /* detached */
+        return -1;
+    }
+
     qemu_mutex_lock(&thr->mutex);
 
     switch (thr->state) {
@@ -486,6 +491,12 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
     s->wait_connect = true;
     qemu_coroutine_yield();
 
+    if (!s->connect_thread) {
+        /* detached */
+        return -1;
+    }
+    assert(thr == s->connect_thread);
+
     qemu_mutex_lock(&thr->mutex);
 
     switch (thr->state) {
-- 
2.29.2



^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PULL 0/1] Block patch for 6.0-rc3
  2021-04-13 13:39 [PULL 0/1] Block patch for 6.0-rc3 Max Reitz
  2021-04-13 13:39 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Max Reitz
@ 2021-04-13 21:11 ` Peter Maydell
  1 sibling, 0 replies; 3+ messages in thread
From: Peter Maydell @ 2021-04-13 21:11 UTC (permalink / raw)
  To: Max Reitz
  Cc: Kevin Wolf, Vladimir Sementsov-Ogievskiy, QEMU Developers, Qemu-block

On Tue, 13 Apr 2021 at 14:39, Max Reitz <mreitz@redhat.com> wrote:
>
> The following changes since commit dce628a97fde2594f99d738883a157f05aa0a14f:
>
>   Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20210412' into staging (2021-04-13 13:05:07 +0100)
>
> are available in the Git repository at:
>
>   https://github.com/XanClic/qemu.git tags/pull-block-2021-04-13
>
> for you to fetch changes up to 0267101af64292c9a84fd9319a763ddfbce9ddc7:
>
>   block/nbd: fix possible use after free of s->connect_thread (2021-04-13 15:35:12 +0200)
>
> (This is the patch for which Vladimir has sent a pull request yesterday.)
>
> ----------------------------------------------------------------
> Block patches for 6.0-rc3:
> - Use-after-free fix for block/nbd.c
>
> ----------------------------------------------------------------
> Vladimir Sementsov-Ogievskiy (1):
>   block/nbd: fix possible use after free of s->connect_thread


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/6.0
for any user-visible changes.

-- PMM


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-04-13 21:13 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-13 13:39 [PULL 0/1] Block patch for 6.0-rc3 Max Reitz
2021-04-13 13:39 ` [PULL 1/1] block/nbd: fix possible use after free of s->connect_thread Max Reitz
2021-04-13 21:11 ` [PULL 0/1] Block patch for 6.0-rc3 Peter Maydell

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).