diff mbox series

[PULL,1/1] block/nbd: fix possible use after free of s->connect_thread

Message ID 20210412121846.144565-2-vsementsov@virtuozzo.com (mailing list archive)
State New, archived
Headers show
Series [PULL,1/1] block/nbd: fix possible use after free of s->connect_thread | expand

Commit Message

Vladimir Sementsov-Ogievskiy April 12, 2021, 12:18 p.m. UTC
If on nbd_close() we detach the thread (in
nbd_co_establish_connection_cancel() thr->state becomes
CONNECT_THREAD_RUNNING_DETACHED), after that point we should not use
s->connect_thread (which is set to NULL), as running thread may free it
at any time.

Still nbd_co_establish_connection() does exactly this: it saves
s->connect_thread to local variable (just for better code style) and
use it even after yield point, when thread may be already detached.

Fix that. Also check thr to be non-NULL on
nbd_co_establish_connection() start for safety.

After this patch "case CONNECT_THREAD_RUNNING_DETACHED" becomes
impossible in the second switch in nbd_co_establish_connection().
Still, don't add extra abort() just before the release. If it somehow
possible to reach this "case:" it won't hurt. Anyway, good refactoring
of all this reconnect mess will come soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Roman Kagan <rvkagan@yandex-team.ru>
 block/nbd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)
diff mbox series


diff --git a/block/nbd.c b/block/nbd.c
index c26dc5a54f..1d4668d42d 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -443,6 +443,11 @@  nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
     BDRVNBDState *s = bs->opaque;
     NBDConnectThread *thr = s->connect_thread;
+    if (!thr) {
+        /* detached */
+        return -1;
+    }
     switch (thr->state) {
@@ -486,6 +491,12 @@  nbd_co_establish_connection(BlockDriverState *bs, Error **errp)
     s->wait_connect = true;
+    if (!s->connect_thread) {
+        /* detached */
+        return -1;
+    }
+    assert(thr == s->connect_thread);
     switch (thr->state) {