qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 026710: block/nbd: fix possible use after fre


From: Peter Maydell
Subject: [Qemu-commits] [qemu/qemu] 026710: block/nbd: fix possible use after free of s->conne...
Date: Tue, 13 Apr 2021 13:10:49 -0700

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 0267101af64292c9a84fd9319a763ddfbce9ddc7
      
https://github.com/qemu/qemu/commit/0267101af64292c9a84fd9319a763ddfbce9ddc7
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
  Date:   2021-04-13 (Tue, 13 Apr 2021)

  Changed paths:
    M block/nbd.c

  Log Message:
  -----------
  block/nbd: fix possible use after free of s->connect_thread

If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.

Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.

Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.

After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: db55d2c9239d445cb7f1fa8ede8e42bd339058f4
      
https://github.com/qemu/qemu/commit/db55d2c9239d445cb7f1fa8ede8e42bd339058f4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-04-13 (Tue, 13 Apr 2021)

  Changed paths:
    M block/nbd.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2021-04-13' 
into staging

Block patches for 6.0-rc3:
- Use-after-free fix for block/nbd.c

# gpg: Signature made Tue 13 Apr 2021 14:35:48 BST
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2021-04-13:
  block/nbd: fix possible use after free of s->connect_thread

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/1b6651533416...db55d2c9239d



reply via email to

[Prev in Thread] Current Thread [Next in Thread]