diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2023-01-10 17:36:33 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2023-02-10 14:12:06 +0100 |
| commit | 5080152e2ef6cde7aa692e29880c62bd54acb750 (patch) | |
| tree | b699617c9ae194c39ff060a78693dc4700b37b69 /block | |
| parent | d76aa73fad1f64c192856e1420ad0756f5e3b778 (diff) | |
| download | qemu-5080152e2ef6cde7aa692e29880c62bd54acb750.zip qemu-5080152e2ef6cde7aa692e29880c62bd54acb750.tar.gz qemu-5080152e2ef6cde7aa692e29880c62bd54acb750.tar.bz2 | |
block/iscsi: fix double-free on BUSY or similar statuses
Commit 8c460269aa77 ("iscsi: base all handling of check condition on
scsi_sense_to_errno", 2019-07-15) removed a "goto out" so that the
same coroutine is re-entered twice; once from iscsi_co_generic_cb,
once from the timer callback iscsi_retry_timer_expired. This can
cause a crash.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1378
Reported-by: Grzegorz Zdanowski <https://gitlab.com/kiler129>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/iscsi.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/iscsi.c b/block/iscsi.c index b3e10f4..3aacd07 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -269,6 +269,7 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status, timer_mod(&iTask->retry_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + retry_time); iTask->do_retry = 1; + return; } else if (status == SCSI_STATUS_CHECK_CONDITION) { int error = iscsi_translate_sense(&task->sense); if (error == EAGAIN) { |