system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-10-14 23:13:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

iscsi: Fix NULL dereferences / races between task completion and abort

Browse source 
Signed-off-by: Stefan Priebe <s.priebe@profihost.ag>
Acked-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Stefan Priebe 2012-08-15 09:09:54 +02:00 committed by Kevin Wolf
parent efb87c1697
commit 64e69e8092
1 changed files with 23 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
block/iscsi.c
View file

@ -76,6 +76,10 @@ static void
iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data, iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
void *private_data) void *private_data)
{ {
IscsiAIOCB *acb = (IscsiAIOCB *)private_data;
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static void static void
@ -84,15 +88,15 @@ iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
IscsiAIOCB *acb = (IscsiAIOCB *)blockacb; IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
IscsiLun *iscsilun = acb->iscsilun; IscsiLun *iscsilun = acb->iscsilun;
acb->common.cb(acb->common.opaque, -ECANCELED);
acb->canceled = 1; acb->canceled = 1;
/* send a task mgmt call to the target to cancel the task on the target */ acb->common.cb(acb->common.opaque, -ECANCELED);
iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
iscsi_abort_task_cb, NULL);
/* then also cancel the task locally in libiscsi */ /* send a task mgmt call to the target to cancel the task on the target
iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task); * this also cancels the task in libiscsi
*/
iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
iscsi_abort_task_cb, &acb);
} }
static AIOPool iscsi_aio_pool = { static AIOPool iscsi_aio_pool = {
@ -179,11 +183,18 @@ iscsi_readv_writev_bh_cb(void *p)
qemu_bh_delete(acb->bh); qemu_bh_delete(acb->bh);
if (acb->canceled == 0) { if (!acb->canceled) {
acb->common.cb(acb->common.opaque, acb->status); acb->common.cb(acb->common.opaque, acb->status);
} }
qemu_aio_release(acb); qemu_aio_release(acb);
if (acb->canceled) {
return;
}
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
@ -197,10 +208,8 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,
g_free(acb->buf); g_free(acb->buf);
if (acb->canceled != 0) { if (acb->canceled) {
qemu_aio_release(acb); qemu_aio_release(acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
return; return;
} }
@ -212,8 +221,6 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,
} }
iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun) static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
@ -298,10 +305,8 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,
trace_iscsi_aio_read16_cb(iscsi, status, acb, acb->canceled); trace_iscsi_aio_read16_cb(iscsi, status, acb, acb->canceled);
if (acb->canceled != 0) { if (acb->canceled) {
qemu_aio_release(acb); qemu_aio_release(acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
return; return;
} }
@ -313,8 +318,6 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,
} }
iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static BlockDriverAIOCB * static BlockDriverAIOCB *
@ -414,10 +417,8 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int status,
{ {
IscsiAIOCB *acb = opaque; IscsiAIOCB *acb = opaque;
if (acb->canceled != 0) { if (acb->canceled) {
qemu_aio_release(acb); qemu_aio_release(acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
return; return;
} }
@ -429,8 +430,6 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int status,
} }
iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static BlockDriverAIOCB * static BlockDriverAIOCB *
@ -468,10 +467,8 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status,
{ {
IscsiAIOCB *acb = opaque; IscsiAIOCB *acb = opaque;
if (acb->canceled != 0) { if (acb->canceled) {
qemu_aio_release(acb); qemu_aio_release(acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
return; return;
} }
@ -483,8 +480,6 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status,
} }
iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static BlockDriverAIOCB * static BlockDriverAIOCB *
@ -528,10 +523,8 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
{ {
IscsiAIOCB *acb = opaque; IscsiAIOCB *acb = opaque;
if (acb->canceled != 0) { if (acb->canceled) {
qemu_aio_release(acb); qemu_aio_release(acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
return; return;
} }
@ -560,8 +553,6 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
} }
iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
scsi_free_scsi_task(acb->task);
acb->task = NULL;
} }
static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs, static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,