From patchwork Wed Aug 15 07:09:54 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Priebe - Profihost AG X-Patchwork-Id: 177552 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 909D22C007F for ; Wed, 15 Aug 2012 17:11:09 +1000 (EST) Received: from localhost ([::1]:55553 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1Xkx-0006mQ-DX for incoming@patchwork.ozlabs.org; Wed, 15 Aug 2012 03:11:07 -0400 Received: from eggs.gnu.org ([208.118.235.92]:59316) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1XkU-0006lh-QC for qemu-devel@nongnu.org; Wed, 15 Aug 2012 03:10:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T1Xjq-0007yU-Ji for qemu-devel@nongnu.org; Wed, 15 Aug 2012 03:10:38 -0400 Received: from mail.profihost.ag ([85.158.179.208]:42352) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1Xjq-0007yP-9z for qemu-devel@nongnu.org; Wed, 15 Aug 2012 03:09:58 -0400 Received: (qmail 19883 invoked from network); 15 Aug 2012 09:09:57 +0200 Received: from fw-office.allied-internet.ag (HELO proxmox2.de-nserver.de) (85.158.179.66) by mail.profihost.ag (qpsmtpd/0.82) with ESMTP; Wed, 15 Aug 2012 09:09:57 +0200 From: Stefan Priebe To: qemu-devel@nongnu.org Date: Wed, 15 Aug 2012 09:09:54 +0200 Message-Id: <1345014594-6020-2-git-send-email-s.priebe@profihost.ag> X-Mailer: git-send-email 1.7.2.5 In-Reply-To: <1345014594-6020-1-git-send-email-s.priebe@profihost.ag> References: <1345014594-6020-1-git-send-email-s.priebe@profihost.ag> X-User-Auth: Auth by ip_allowed_85.158.179.66 through 85.158.179.66 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 85.158.179.208 Cc: ronniesahlberg@gmail.com, Stefan Priebe Subject: [Qemu-devel] [PATCH] PATCH V2: fix NULL dereferences / races between task completition and abort X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Signed-off-by: Stefan Priebe Acked-by: Ronnie Sahlberg --- block/iscsi.c | 55 +++++++++++++++++++++++-------------------------------- 1 files changed, 23 insertions(+), 32 deletions(-) diff --git a/block/iscsi.c b/block/iscsi.c index 12ca76d..1c8b049 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -76,6 +76,10 @@ static void iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data, void *private_data) { + IscsiAIOCB *acb = (IscsiAIOCB *)private_data; + + scsi_free_scsi_task(acb->task); + acb->task = NULL; } static void @@ -84,15 +88,15 @@ iscsi_aio_cancel(BlockDriverAIOCB *blockacb) IscsiAIOCB *acb = (IscsiAIOCB *)blockacb; IscsiLun *iscsilun = acb->iscsilun; - acb->common.cb(acb->common.opaque, -ECANCELED); acb->canceled = 1; - /* send a task mgmt call to the target to cancel the task on the target */ - iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task, - iscsi_abort_task_cb, NULL); + acb->common.cb(acb->common.opaque, -ECANCELED); - /* then also cancel the task locally in libiscsi */ - iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task); + /* send a task mgmt call to the target to cancel the task on the target + * this also cancels the task in libiscsi + */ + iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task, + iscsi_abort_task_cb, &acb); } static AIOPool iscsi_aio_pool = { @@ -179,11 +183,18 @@ iscsi_readv_writev_bh_cb(void *p) qemu_bh_delete(acb->bh); - if (acb->canceled == 0) { + if (!acb->canceled) { acb->common.cb(acb->common.opaque, acb->status); } qemu_aio_release(acb); + + if (acb->canceled) { + return; + } + + scsi_free_scsi_task(acb->task); + acb->task = NULL; } @@ -197,10 +208,8 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status, g_free(acb->buf); - if (acb->canceled != 0) { + if (acb->canceled) { qemu_aio_release(acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; return; } @@ -212,8 +221,6 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status, } iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; } static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun) @@ -298,10 +305,8 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status, trace_iscsi_aio_read16_cb(iscsi, status, acb, acb->canceled); - if (acb->canceled != 0) { + if (acb->canceled) { qemu_aio_release(acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; return; } @@ -313,8 +318,6 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status, } iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; } static BlockDriverAIOCB * @@ -414,10 +417,8 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int status, { IscsiAIOCB *acb = opaque; - if (acb->canceled != 0) { + if (acb->canceled) { qemu_aio_release(acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; return; } @@ -429,8 +430,6 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int status, } iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; } static BlockDriverAIOCB * @@ -468,10 +467,8 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status, { IscsiAIOCB *acb = opaque; - if (acb->canceled != 0) { + if (acb->canceled) { qemu_aio_release(acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; return; } @@ -483,8 +480,6 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status, } iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; } static BlockDriverAIOCB * @@ -528,10 +523,8 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status, { IscsiAIOCB *acb = opaque; - if (acb->canceled != 0) { + if (acb->canceled) { qemu_aio_release(acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; return; } @@ -560,8 +553,6 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status, } iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb); - scsi_free_scsi_task(acb->task); - acb->task = NULL; } static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,