diff options
author | Stefan Hajnoczi <stefanha@redhat.com> | 2019-07-23 20:06:23 +0100 |
---|---|---|
committer | Stefan Hajnoczi <stefanha@redhat.com> | 2019-08-22 15:49:19 +0100 |
commit | f0f81002873c06fdef9bb2a272ddfd26af65b851 (patch) | |
tree | 1f4b14f40759169ebc8ae4f5c16e26d303f13fbd /hw/scsi/vhost-user-scsi.c | |
parent | 33f18cf7dca7741d3647d514040904ce83edd73d (diff) |
util/async: hold AioContext ref to prevent use-after-free
The tests/test-bdrv-drain /bdrv-drain/iothread/drain test case does the
following:
1. The preadv coroutine calls aio_bh_schedule_oneshot() and then yields.
2. The one-shot BH executes in another AioContext. All it does is call
aio_co_wakeup(preadv_co).
3. The preadv coroutine is re-entered and returns.
There is a race condition in aio_co_wake() where the preadv coroutine
returns and the test case destroys the preadv IOThread. aio_co_wake()
can still be running in the other AioContext and it performs an access
to the freed IOThread AioContext.
Here is the race in aio_co_schedule():
QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
co, co_scheduled_next);
<-- race: co may execute before we invoke qemu_bh_schedule()!
qemu_bh_schedule(ctx->co_schedule_bh);
So if co causes ctx to be freed then we're in trouble. Fix this problem
by holding a reference to ctx.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20190723190623.21537-1-stefanha@redhat.com
Message-Id: <20190723190623.21537-1-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/scsi/vhost-user-scsi.c')
0 files changed, 0 insertions, 0 deletions