diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2023-01-10 17:36:33 +0100 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-03-29 10:20:04 +0300 |
| commit | 856a67cadea901221c69fb4251c038389a5d4571 (patch) | |
| tree | 19e941609f013a29fe2d0d352bc3f555a0e80bd1 /block/iscsi.c | |
| parent | f163cf6be4b7b51f7327d264ea2572f8b495d287 (diff) | |
block/iscsi: fix double-free on BUSY or similar statuses
Commit 8c460269aa77 ("iscsi: base all handling of check condition on
scsi_sense_to_errno", 2019-07-15) removed a "goto out" so that the
same coroutine is re-entered twice; once from iscsi_co_generic_cb,
once from the timer callback iscsi_retry_timer_expired. This can
cause a crash.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1378
Reported-by: Grzegorz Zdanowski <https://gitlab.com/kiler129>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 5080152e2ef6cde7aa692e29880c62bd54acb750)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'block/iscsi.c')
| -rw-r--r-- | block/iscsi.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/iscsi.c b/block/iscsi.c index a316d46d96..1bba42a71b 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -268,6 +268,7 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status, timer_mod(&iTask->retry_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + retry_time); iTask->do_retry = 1; + return; } else if (status == SCSI_STATUS_CHECK_CONDITION) { int error = iscsi_translate_sense(&task->sense); if (error == EAGAIN) { |