diff options
| author | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2021-04-06 18:51:14 +0300 |
|---|---|---|
| committer | Max Reitz <mreitz@redhat.com> | 2021-04-13 15:35:12 +0200 |
| commit | 0267101af64292c9a84fd9319a763ddfbce9ddc7 (patch) | |
| tree | 1fdbfb0a65f1afd795e6e5b8baa2ed1e00ae4ac6 | |
| parent | dce628a97fde2594f99d738883a157f05aa0a14f (diff) | |
| download | qemu-0267101af64292c9a84fd9319a763ddfbce9ddc7.zip qemu-0267101af64292c9a84fd9319a763ddfbce9ddc7.tar.gz qemu-0267101af64292c9a84fd9319a763ddfbce9ddc7.tar.bz2 | |
block/nbd: fix possible use after free of s->connect_thread
If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.
Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.
Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.
After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210406155114.1057355-1-vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
Signed-off-by: Max Reitz <mreitz@redhat.com>
| -rw-r--r-- | block/nbd.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/block/nbd.c b/block/nbd.c index c26dc5a..1d4668d 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -443,6 +443,11 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp) BDRVNBDState *s = bs->opaque; NBDConnectThread *thr = s->connect_thread; + if (!thr) { + /* detached */ + return -1; + } + qemu_mutex_lock(&thr->mutex); switch (thr->state) { @@ -486,6 +491,12 @@ nbd_co_establish_connection(BlockDriverState *bs, Error **errp) s->wait_connect = true; qemu_coroutine_yield(); + if (!s->connect_thread) { + /* detached */ + return -1; + } + assert(thr == s->connect_thread); + qemu_mutex_lock(&thr->mutex); switch (thr->state) { |