[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v8.0.1 21/36] block: Fix use after free in blockdev_mark_auto_del
From: |
Michael Tokarev |
Subject: |
[PATCH v8.0.1 21/36] block: Fix use after free in blockdev_mark_auto_del() |
Date: |
Wed, 17 May 2023 11:00:41 +0300 |
From: Kevin Wolf <kwolf@redhat.com>
job_cancel_locked() drops the job list lock temporarily and it may call
aio_poll(). We must assume that the list has changed after this call.
Also, with unlucky timing, it can end up freeing the job during
job_completed_txn_abort_locked(), making the job pointer invalid, too.
For both reasons, we can't just continue at block_job_next_locked(job).
Instead, start at the head of the list again after job_cancel_locked()
and skip those jobs that we already cancelled (or that are completing
anyway).
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20230503140142.474404-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit e2626874a32602d4e52971c786ef5ffb4430629d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
blockdev.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/blockdev.c b/blockdev.c
index d7b5c18f0a..2c1752a403 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -153,12 +153,22 @@ void blockdev_mark_auto_del(BlockBackend *blk)
JOB_LOCK_GUARD();
- for (job = block_job_next_locked(NULL); job;
- job = block_job_next_locked(job)) {
- if (block_job_has_bdrv(job, blk_bs(blk))) {
+ do {
+ job = block_job_next_locked(NULL);
+ while (job && (job->job.cancelled ||
+ job->job.deferred_to_main_loop ||
+ !block_job_has_bdrv(job, blk_bs(blk))))
+ {
+ job = block_job_next_locked(job);
+ }
+ if (job) {
+ /*
+ * This drops the job lock temporarily and polls, so we need to
+ * restart processing the list from the start after this.
+ */
job_cancel_locked(&job->job, false);
}
- }
+ } while (job);
dinfo->auto_del = 1;
}
--
2.39.2
- [PATCH v8.0.1 10/36] hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc(), (continued)
- [PATCH v8.0.1 10/36] hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 07/36] qemu-options: finesse the recommendations around -blockdev, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 05/36] acpi: pcihp: allow repeating hot-unplug requests, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 11/36] hw/arm/boot: Make write_bootloader() public as arm_write_bootloader(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 16/36] hw/sd/allwinner-sdhost: Correctly byteswap descriptor fields, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 23/36] block: bdrv/blk_co_unref() for calls in coroutine context, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 14/36] hw/intc/allwinner-a10-pic: Don't use set_bit()/clear_bit(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 22/36] block: Consistently call bdrv_activate() outside coroutine, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 20/36] meson: leave unnecessary modules out of the build, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 18/36] block/export: call blk_set_dev_ops(blk, NULL, NULL), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 21/36] block: Fix use after free in blockdev_mark_auto_del(),
Michael Tokarev <=
- [PATCH v8.0.1 15/36] target/arm: Define and use new load_cpu_field_low32(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 19/36] softfloat: Fix the incorrect computation in float32_exp2, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 24/36] block: Don't call no_coroutine_fns in qmp_block_resize(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 13/36] hw/arm/raspi: Use arm_write_bootloader() to write boot code, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 17/36] hw/net/allwinner-sun8i-emac: Correctly byteswap descriptor fields, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 28/36] accel/tcg: Fix atomic_mmu_lookup for reads, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 27/36] hw/pci-bridge: pci_expander_bridge fix type in pxb_cxl_dev_reset(), Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 26/36] target/riscv: Restore the predicate() NULL check behavior, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 29/36] target/arm: Fix handling of SW and NSW bits for stage 2 walks, Michael Tokarev, 2023/05/17
- [PATCH v8.0.1 25/36] target/riscv: Fix itrigger when icount is used, Michael Tokarev, 2023/05/17