mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c100448790
qemu/block
History
Stefan Hajnoczi c100448790 block/iscsi: fix ioctl cancel use-after-free 
iscsi_aio_cancel() does not increment the request's reference count,
causing a use-after-free when ABORT TASK finishes after the request has
already completed.

There are some additional issues with iscsi_aio_cancel():
1. Several ABORT TASKs may be sent for the same task if
   iscsi_aio_cancel() is invoked multiple times.  It's better to avoid
   this just in case the command identifier is reused.
2. The iscsilun->mutex protection is missing in iscsi_aio_cancel().

Reported-by: Felipe Franciosi <felipe@nutanix.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20180203061621.7033-4-stefanha@redhat.com>
Reviewed-by: Felipe Franciosi <felipe@nutanix.com>
Tested-by: Sreejith Mohanan <sreejit.mohanan@nutanix.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-01-11 13:57:24 +01:00
..
accounting.c block/accounting: introduce latency histogram 2018-03-19 14:58:37 -05:00
backup.c block/backup: drop unused synchronization interface 2018-12-14 11:52:40 +01:00
blkdebug.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
blklogwrites.c block: Use BdrvChild to discard 2018-07-10 16:01:52 +02:00
blkreplay.c trivial: Make bios files and source files non-executable 2018-09-25 17:26:18 +02:00
blkverify.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
block-backend.c block: Null pointer dereference in blk_root_get_parent_desc() 2018-11-12 17:49:21 +01:00
bochs.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
cloop.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
commit.c block: Use bdrv_reopen_set_read_only() in bdrv_commit() 2018-12-14 11:55:01 +01:00
copy-on-read.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
create.c jobs: utilize job_exit shim 2018-08-31 16:28:33 +02:00
crypto.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
crypto.h block/crypto: Simplify block_crypto_{open,create}_opts_init() 2018-06-29 14:20:56 +02:00
curl.c curl: Support auto-read-only option 2018-11-05 15:09:55 +01:00
dirty-bitmap.c dirty-bitmaps: clean-up bitmaps loading and migration logic 2018-10-29 16:23:17 -04:00
dmg-bz2.c dmg: Move libbz2 code to dmg-bz2.so 2016-10-07 14:14:06 +02:00
dmg-lzfse.c block: adding lzfse decompressing support as a module. 2018-12-14 11:52:40 +01:00
dmg.c dmg: don't skip zero chunk 2019-01-04 11:15:09 +00:00
dmg.h dmg: including dmg-lzfse module inside dmg block driver. 2018-12-14 11:52:40 +01:00
file-posix.c file-posix: Avoid aio_worker() for QEMU_AIO_IOCTL 2018-12-14 11:54:49 +01:00
file-win32.c block: Prefix file driver trace points with "file_" 2018-07-10 16:01:51 +02:00
gluster.c gluster: Support auto-read-only option 2018-11-05 15:09:55 +01:00
io.c block: Use a single global AioWait 2018-09-25 15:50:15 +02:00
iscsi-opts.c Move include qemu/option.h from qemu-common.h to actual users 2018-02-09 13:52:16 +01:00
iscsi.c block/iscsi: fix ioctl cancel use-after-free 2019-01-11 13:57:24 +01:00
linux-aio.c block/linux-aio: acquire AioContext before qemu_laio_process_completions 2018-09-25 15:50:15 +02:00
Makefile.objs configure: adding support to lzfse library. 2018-12-14 11:52:40 +01:00
mirror.c block/mirror: add missing coroutine_fn annotations 2018-12-14 11:55:02 +01:00
nbd-client.c block/nbd-client: use traces instead of noisy error_report_err 2019-01-04 17:34:58 -06:00
nbd-client.h nbd/client: Add x-dirty-bitmap to query bitmap from server 2018-07-02 15:27:38 -05:00
nbd.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
nfs.c block: Convert .bdrv_truncate callback to coroutine_fn 2018-06-29 14:20:56 +02:00
null.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
nvme.c block/nvme: optimize the performance of nvme driver based on vfio-pci 2019-01-09 09:38:34 +08:00
parallels.c parallels: Switch to byte-based calls 2018-06-29 14:20:56 +02:00
parallels.h Clean up includes 2018-02-09 05:05:11 +01:00
qapi.c block/qapi: Fix memory leak in qmp_query_blockstats() 2018-08-15 12:50:39 +02:00
qcow2-bitmap.c block/qcow2-bitmap: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
qcow2-cache.c qcow2: Allow configuring the L2 slice size 2018-02-13 17:00:00 +01:00
qcow2-cluster.c qcow2: move decompression from qcow2-cluster.c to qcow2.c 2018-12-14 11:52:40 +01:00
qcow2-refcount.c qcow2: Don't allow overflow during cluster allocation 2018-11-19 12:51:40 +01:00
qcow2-snapshot.c block: use local path for local headers 2018-05-31 04:16:06 +03:00
qcow2.c qcow2: do decompression in threads 2018-12-14 11:52:41 +01:00
qcow2.h qcow2: aio support for compressed cluster read 2018-12-14 11:52:41 +01:00
qcow.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
qed-check.c block: convert bdrv_check callback to coroutine_fn 2018-03-09 15:17:47 +01:00
qed-cluster.c qed: protect table cache with CoMutex 2017-07-17 11:34:11 +08:00
qed-l2-cache.c qed: protect table cache with CoMutex 2017-07-17 11:34:11 +08:00
qed-table.c block: convert bdrv_check callback to coroutine_fn 2018-03-09 15:17:47 +01:00
qed.c error: Fix use of error_prepend() with &error_fatal, &error_abort 2018-10-19 14:51:34 +02:00
qed.h qed: protect table cache with CoMutex 2017-07-17 11:34:11 +08:00
quorum.c quorum: Forbid adding children in blkverify mode 2018-11-05 15:09:54 +01:00
raw-format.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
rbd.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
replication.c block: Remove flags parameter from bdrv_reopen_queue() 2018-12-14 11:55:02 +01:00
sheepdog.c block: Use warn_report() & friends to report warnings 2018-10-19 14:51:34 +02:00
snapshot.c block: make .bdrv_close optional 2018-08-15 12:50:39 +02:00
ssh.c block: Convert .bdrv_truncate callback to coroutine_fn 2018-06-29 14:20:56 +02:00
stream.c block: Use bdrv_reopen_set_read_only() in stream_start/complete() 2018-12-14 11:55:02 +01:00
throttle-groups.c throttle-groups: Don't allow timers without throttled requests 2018-08-15 12:50:39 +02:00
throttle.c block: Use BdrvChild to discard 2018-07-10 16:01:52 +02:00
trace-events block/nbd-client: use traces instead of noisy error_report_err 2019-01-04 17:34:58 -06:00
vdi.c vdi: Use a literal number of bytes for DEFAULT_CLUSTER_SIZE 2018-11-05 15:28:48 +01:00
vhdx-endian.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx-log.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx.h block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vmdk.c vmdk: align end of file to a sector boundary 2018-09-26 10:47:18 +08:00
vpc.c vpc: Don't leak opts in vpc_open() 2018-11-05 15:09:54 +01:00
vvfat.c vvfat: Fix memory leak 2018-11-19 12:51:40 +01:00
vxhs.c block: Add block-specific QDict header 2018-06-15 14:49:44 +02:00
win32-aio.c file-win32: Switch to byte-based callbacks 2018-05-15 16:11:41 +02:00
write-threshold.c qapi: Drop qapi_event_send_FOO()'s Error ** argument 2018-08-28 18:21:38 +02:00