ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hw/nvme: fix aio cancel in flush 

Make sure that iocb->aiocb is NULL'ed when cancelling.

Fix a potential use-after-free by removing the bottom half and enqueuing
the completion directly.

Fixes: 38f4ac65ac ("hw/nvme: reimplement flush to allow cancellation")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
This commit is contained in:
Klaus Jensen 2022-11-10 07:59:44 +01:00
parent 433c71e494
commit 3dbc1708ea
1 changed files with 6 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hw/nvme/ctrl.c
View File

@ -3160,7 +3160,6 @@ typedef struct NvmeFlushAIOCB {
BlockAIOCB common; BlockAIOCB common;
BlockAIOCB *aiocb; BlockAIOCB *aiocb;
NvmeRequest *req; NvmeRequest *req;
QEMUBH *bh;
int ret; int ret;
NvmeNamespace *ns; NvmeNamespace *ns;
@ -3176,6 +3175,7 @@ static void nvme_flush_cancel(BlockAIOCB *acb)
if (iocb->aiocb) { if (iocb->aiocb) {
blk_aio_cancel_async(iocb->aiocb); blk_aio_cancel_async(iocb->aiocb);
iocb->aiocb = NULL;
} }
} }
@ -3185,6 +3185,8 @@ static const AIOCBInfo nvme_flush_aiocb_info = {
.get_aio_context = nvme_get_aio_context, .get_aio_context = nvme_get_aio_context,
}; };
static void nvme_do_flush(NvmeFlushAIOCB *iocb);
static void nvme_flush_ns_cb(void *opaque, int ret) static void nvme_flush_ns_cb(void *opaque, int ret)
{ {
NvmeFlushAIOCB *iocb = opaque; NvmeFlushAIOCB *iocb = opaque;
@ -3206,13 +3208,11 @@ static void nvme_flush_ns_cb(void *opaque, int ret)
} }
out: out:
iocb->aiocb = NULL; nvme_do_flush(iocb);
qemu_bh_schedule(iocb->bh);
} }
static void nvme_flush_bh(void *opaque) static void nvme_do_flush(NvmeFlushAIOCB *iocb)
{ {
NvmeFlushAIOCB *iocb = opaque;
NvmeRequest *req = iocb->req; NvmeRequest *req = iocb->req;
NvmeCtrl *n = nvme_ctrl(req); NvmeCtrl *n = nvme_ctrl(req);
int i; int i;
@ -3239,14 +3239,8 @@ static void nvme_flush_bh(void *opaque)
return; return;
done: done:
qemu_bh_delete(iocb->bh);
iocb->bh = NULL;
iocb->common.cb(iocb->common.opaque, iocb->ret); iocb->common.cb(iocb->common.opaque, iocb->ret);
qemu_aio_unref(iocb); qemu_aio_unref(iocb);
return;
} }
static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req) static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
@ -3258,7 +3252,6 @@ static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req); iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req);
iocb->req = req; iocb->req = req;
iocb->bh = qemu_bh_new(nvme_flush_bh, iocb);
iocb->ret = 0; iocb->ret = 0;
iocb->ns = NULL; iocb->ns = NULL;
iocb->nsid = 0; iocb->nsid = 0;
@ -3280,13 +3273,11 @@ static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
} }
req->aiocb = &iocb->common; req->aiocb = &iocb->common;
qemu_bh_schedule(iocb->bh); nvme_do_flush(iocb);
return NVME_NO_COMPLETE; return NVME_NO_COMPLETE;
out: out:
qemu_bh_delete(iocb->bh);
iocb->bh = NULL;
qemu_aio_unref(iocb); qemu_aio_unref(iocb);
return status; return status;