packages/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nbd/server.c: fix invalid read after client was already free

Browse Source 
In the process of NBD equipment pressurization, executing QEMU NBD will
lead to the failure of IO distribution and go to NBD_ Out process of trip().
If two or more IO go to the out process, client NBD will release in nbd_request_put().
The user after free problem that is read again in close().
Through the NBD_ Save the value of client > closing before the out process in trip
to solve the use after free problem.

Signed-off-by: wangjian161 <wangjian161@huawei.com>
This commit is contained in:
Chen Qun 2022-02-09 10:42:33 +08:00 committed by yezengruan
parent 42a3ff7919
commit 3f9841ed96
1 changed files with 45 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
nbd-server.c-fix-invalid-read-after-client-was-alrea.patch Normal file
View File

@ -0,0 +1,45 @@
From 4b156248776f734d63fe37629d56c40234fda9c0 Mon Sep 17 00:00:00 2001
From: WangJian <wangjian161@huawei.com>
Date: Wed, 9 Feb 2022 10:42:33 +0800
Subject: [PATCH] nbd/server.c: fix invalid read after client was already free
In the process of NBD equipment pressurization, executing QEMU NBD will
lead to the failure of IO distribution and go to NBD_ Out process of trip().
If two or more IO go to the out process, client NBD will release in nbd_request_put().
The user after free problem that is read again in close().
Through the NBD_ Save the value of client > closing before the out process in trip
to solve the use after free problem.
Signed-off-by: wangjian161 <wangjian161@huawei.com>
---
nbd/server.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/nbd/server.c b/nbd/server.c
index 4630dd7322..37515ed520 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -2606,6 +2606,7 @@ static coroutine_fn void nbd_trip(void *opaque)
NBDRequestData *req;
NBDRequest request = { 0 }; /* GCC thinks it can be used uninitialized */
int ret;
+ bool client_closing;
Error *local_err = NULL;
trace_nbd_trip();
@@ -2681,8 +2682,11 @@ disconnect:
if (local_err) {
error_reportf_err(local_err, "Disconnect client, due to: ");
}
+ client_closing = client->closing;
nbd_request_put(req);
- client_close(client, true);
+ if (!client_closing) {
+ client_close(client, true);
+ }
nbd_client_put(client);
}
--
2.27.0