aboutsummaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@redhat.com>2018-02-03 07:16:21 +0100
committerPaolo Bonzini <pbonzini@redhat.com>2019-01-11 13:57:24 +0100
commitc100448790b8494ca69f89a88c5833d767a87dc1 (patch)
treeeaff76b7e1bd8c224871b48bd8c370eddc211bf9 /block
parent83d11973fa78be5bf0fd0e00791245e974fe4af3 (diff)
downloadqemu-c100448790b8494ca69f89a88c5833d767a87dc1.zip
qemu-c100448790b8494ca69f89a88c5833d767a87dc1.tar.gz
qemu-c100448790b8494ca69f89a88c5833d767a87dc1.tar.bz2
block/iscsi: fix ioctl cancel use-after-free
iscsi_aio_cancel() does not increment the request's reference count, causing a use-after-free when ABORT TASK finishes after the request has already completed. There are some additional issues with iscsi_aio_cancel(): 1. Several ABORT TASKs may be sent for the same task if iscsi_aio_cancel() is invoked multiple times. It's better to avoid this just in case the command identifier is reused. 2. The iscsilun->mutex protection is missing in iscsi_aio_cancel(). Reported-by: Felipe Franciosi <felipe@nutanix.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20180203061621.7033-4-stefanha@redhat.com> Reviewed-by: Felipe Franciosi <felipe@nutanix.com> Tested-by: Sreejith Mohanan <sreejit.mohanan@nutanix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'block')
-rw-r--r--block/iscsi.c21
1 files changed, 18 insertions, 3 deletions
diff --git a/block/iscsi.c b/block/iscsi.c
index 1924a2b..abb872d 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -124,6 +124,7 @@ typedef struct IscsiAIOCB {
#ifdef __linux__
sg_io_hdr_t *ioh;
#endif
+ bool cancelled;
} IscsiAIOCB;
/* libiscsi uses time_t so its enough to process events every second */
@@ -287,6 +288,7 @@ static void iscsi_co_init_iscsitask(IscsiLun *iscsilun, struct IscsiTask *iTask)
};
}
+/* Called (via iscsi_service) with QemuMutex held. */
static void
iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
void *private_data)
@@ -295,6 +297,7 @@ iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
acb->status = -ECANCELED;
iscsi_schedule_bh(acb);
+ qemu_aio_unref(acb); /* acquired in iscsi_aio_cancel() */
}
static void
@@ -303,14 +306,25 @@ iscsi_aio_cancel(BlockAIOCB *blockacb)
IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
IscsiLun *iscsilun = acb->iscsilun;
- if (acb->status != -EINPROGRESS) {
+ qemu_mutex_lock(&iscsilun->mutex);
+
+ /* If it was cancelled or completed already, our work is done here */
+ if (acb->cancelled || acb->status != -EINPROGRESS) {
+ qemu_mutex_unlock(&iscsilun->mutex);
return;
}
+ acb->cancelled = true;
+
+ qemu_aio_ref(acb); /* released in iscsi_abort_task_cb() */
+
/* send a task mgmt call to the target to cancel the task on the target */
- iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
- iscsi_abort_task_cb, acb);
+ if (iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
+ iscsi_abort_task_cb, acb) < 0) {
+ qemu_aio_unref(acb); /* since iscsi_abort_task_cb() won't be called */
+ }
+ qemu_mutex_unlock(&iscsilun->mutex);
}
static const AIOCBInfo iscsi_aiocb_info = {
@@ -1008,6 +1022,7 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
acb->bh = NULL;
acb->status = -EINPROGRESS;
acb->ioh = buf;
+ acb->cancelled = false;
if (req != SG_IO) {
iscsi_ioctl_handle_emulated(acb, req, buf);