OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
c100448790
qemu-e2k/block
History
Stefan Hajnoczi c100448790 block/iscsi: fix ioctl cancel use-after-free 
iscsi_aio_cancel() does not increment the request's reference count,
causing a use-after-free when ABORT TASK finishes after the request has
already completed.

There are some additional issues with iscsi_aio_cancel():
1. Several ABORT TASKs may be sent for the same task if
   iscsi_aio_cancel() is invoked multiple times.  It's better to avoid
   this just in case the command identifier is reused.
2. The iscsilun->mutex protection is missing in iscsi_aio_cancel().

Reported-by: Felipe Franciosi <felipe@nutanix.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20180203061621.7033-4-stefanha@redhat.com>
Reviewed-by: Felipe Franciosi <felipe@nutanix.com>
Tested-by: Sreejith Mohanan <sreejit.mohanan@nutanix.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-01-11 13:57:24 +01:00
..
accounting.c
backup.c block/backup: drop unused synchronization interface 2018-12-14 11:52:40 +01:00
blkdebug.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
blklogwrites.c
blkreplay.c trivial: Make bios files and source files non-executable 2018-09-25 17:26:18 +02:00
blkverify.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
block-backend.c block: Null pointer dereference in blk_root_get_parent_desc() 2018-11-12 17:49:21 +01:00
bochs.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
cloop.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
commit.c block: Use bdrv_reopen_set_read_only() in bdrv_commit() 2018-12-14 11:55:01 +01:00
copy-on-read.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
create.c jobs: utilize job_exit shim 2018-08-31 16:28:33 +02:00
crypto.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
crypto.h
curl.c curl: Support auto-read-only option 2018-11-05 15:09:55 +01:00
dirty-bitmap.c dirty-bitmaps: clean-up bitmaps loading and migration logic 2018-10-29 16:23:17 -04:00
dmg-bz2.c
dmg-lzfse.c block: adding lzfse decompressing support as a module. 2018-12-14 11:52:40 +01:00
dmg.c dmg: don't skip zero chunk 2019-01-04 11:15:09 +00:00
dmg.h dmg: including dmg-lzfse module inside dmg block driver. 2018-12-14 11:52:40 +01:00
file-posix.c file-posix: Avoid aio_worker() for QEMU_AIO_IOCTL 2018-12-14 11:54:49 +01:00
file-win32.c
gluster.c gluster: Support auto-read-only option 2018-11-05 15:09:55 +01:00
io.c block: Use a single global AioWait 2018-09-25 15:50:15 +02:00
iscsi-opts.c
iscsi.c block/iscsi: fix ioctl cancel use-after-free 2019-01-11 13:57:24 +01:00
linux-aio.c block/linux-aio: acquire AioContext before qemu_laio_process_completions 2018-09-25 15:50:15 +02:00
Makefile.objs configure: adding support to lzfse library. 2018-12-14 11:52:40 +01:00
mirror.c block/mirror: add missing coroutine_fn annotations 2018-12-14 11:55:02 +01:00
nbd-client.c block/nbd-client: use traces instead of noisy error_report_err 2019-01-04 17:34:58 -06:00
nbd-client.h
nbd.c qstring: Move qstring_from_substr()'s @end one to the right 2018-07-28 09:09:58 +02:00
nfs.c
null.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
nvme.c block/nvme: optimize the performance of nvme driver based on vfio-pci 2019-01-09 09:38:34 +08:00
parallels.c
parallels.h
qapi.c block/qapi: Fix memory leak in qmp_query_blockstats() 2018-08-15 12:50:39 +02:00
qcow2-bitmap.c block/qcow2-bitmap: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
qcow2-cache.c
qcow2-cluster.c qcow2: move decompression from qcow2-cluster.c to qcow2.c 2018-12-14 11:52:40 +01:00
qcow2-refcount.c qcow2: Don't allow overflow during cluster allocation 2018-11-19 12:51:40 +01:00
qcow2-snapshot.c
qcow2.c qcow2: do decompression in threads 2018-12-14 11:52:41 +01:00
qcow2.h qcow2: aio support for compressed cluster read 2018-12-14 11:52:41 +01:00
qcow.c crypto: support multiple threads accessing one QCryptoBlock 2018-12-12 11:16:49 +00:00
qed-check.c
qed-cluster.c
qed-l2-cache.c
qed-table.c
qed.c error: Fix use of error_prepend() with &error_fatal, &error_abort 2018-10-19 14:51:34 +02:00
qed.h
quorum.c quorum: Forbid adding children in blkverify mode 2018-11-05 15:09:54 +01:00
raw-format.c block: drop empty .bdrv_close handlers 2018-08-15 12:50:39 +02:00
rbd.c block: Require auto-read-only for existing fallbacks 2018-11-05 15:09:55 +01:00
replication.c block: Remove flags parameter from bdrv_reopen_queue() 2018-12-14 11:55:02 +01:00
sheepdog.c block: Use warn_report() & friends to report warnings 2018-10-19 14:51:34 +02:00
snapshot.c block: make .bdrv_close optional 2018-08-15 12:50:39 +02:00
ssh.c
stream.c block: Use bdrv_reopen_set_read_only() in stream_start/complete() 2018-12-14 11:55:02 +01:00
throttle-groups.c throttle-groups: Don't allow timers without throttled requests 2018-08-15 12:50:39 +02:00
throttle.c
trace-events block/nbd-client: use traces instead of noisy error_report_err 2019-01-04 17:34:58 -06:00
vdi.c vdi: Use a literal number of bytes for DEFAULT_CLUSTER_SIZE 2018-11-05 15:28:48 +01:00
vhdx-endian.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx-log.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx.c block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vhdx.h block/vhdx: Don't take address of fields in packed structs 2018-11-05 15:09:54 +01:00
vmdk.c vmdk: align end of file to a sector boundary 2018-09-26 10:47:18 +08:00
vpc.c vpc: Don't leak opts in vpc_open() 2018-11-05 15:09:54 +01:00
vvfat.c vvfat: Fix memory leak 2018-11-19 12:51:40 +01:00
vxhs.c
win32-aio.c
write-threshold.c qapi: Drop qapi_event_send_FOO()'s Error ** argument 2018-08-28 18:21:38 +02:00