[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 58/79] nbd: Fully initialize client in case of faile
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 58/79] nbd: Fully initialize client in case of failed negotiation |
Date: |
Mon, 28 Aug 2017 19:14:33 -0500 |
From: Eric Blake <address@hidden>
If a non-NBD client connects to qemu-nbd, we would end up with
a SIGSEGV in nbd_client_put() because we were trying to
unregister the client's association to the export, even though
we skipped inserting the client into that list. Easy trigger
in two terminals:
$ qemu-nbd -p 30001 --format=raw file
$ nmap 127.0.0.1 -p 30001
nmap claims that it thinks it connected to a pago-services1
server (which probably means nmap could be updated to learn the
NBD protocol and give a more accurate diagnosis of the open
port - but that's not our problem), then terminates immediately,
so our call to nbd_negotiate() fails. The fix is to reorder
nbd_co_client_start() to ensure that all initialization occurs
before we ever try talking to a client in nbd_negotiate(), so
that the teardown sequence on negotiation failure doesn't fault
while dereferencing a half-initialized object.
While debugging this, I also noticed that nbd_update_server_watch()
called by nbd_client_closed() was still adding a channel to accept
the next client, even when the state was no longer RUNNING. That
is fixed by making nbd_can_accept() pay attention to the current
state.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1451614
Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit df8ad9f128c15aa0a0ebc7b24e9a22c9775b67af)
Signed-off-by: Michael Roth <address@hidden>
---
nbd/server.c | 8 +++-----
qemu-nbd.c | 2 +-
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/nbd/server.c b/nbd/server.c
index 924a1fe..edfda84 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1376,16 +1376,14 @@ static coroutine_fn void nbd_co_client_start(void
*opaque)
if (exp) {
nbd_export_get(exp);
+ QTAILQ_INSERT_TAIL(&exp->clients, client, next);
}
+ qemu_co_mutex_init(&client->send_lock);
+
if (nbd_negotiate(data)) {
client_close(client);
goto out;
}
- qemu_co_mutex_init(&client->send_lock);
-
- if (exp) {
- QTAILQ_INSERT_TAIL(&exp->clients, client, next);
- }
nbd_client_receive_next_request(client);
diff --git a/qemu-nbd.c b/qemu-nbd.c
index e4f00e2..14e7947 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -324,7 +324,7 @@ out:
static int nbd_can_accept(void)
{
- return nb_fds < shared;
+ return state == RUNNING && nb_fds < shared;
}
static void nbd_export_closed(NBDExport *exp)
--
2.7.4
- [Qemu-devel] [PATCH 44/79] block: Simplify BDRV_BLOCK_RAW recursion, (continued)
- [Qemu-devel] [PATCH 44/79] block: Simplify BDRV_BLOCK_RAW recursion, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 49/79] tests: check-qom-proplist: add checks for cmdline-created objects, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 53/79] target/ppc: fix memory leak in kvmppc_is_mem_backend_page_size_ok(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 55/79] spapr: fix memory leak in spapr_memory_pre_plug(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 37/79] virtio-net: fix wild pointer when remove virtio-net queues, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 38/79] blkdebug: Sanity check block layer guarantees, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 52/79] target/ppc: pass const string to kvmppc_is_mem_backend_page_size_ok(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 54/79] spapr: add pre_plug function for memory, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 48/79] linuxboot_dma: compile for i486, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 51/79] pc: Use "min-[x]level" on compat_props, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 58/79] nbd: Fully initialize client in case of failed negotiation,
Michael Roth <=
- [Qemu-devel] [PATCH 63/79] nbd: fix NBD over TLS, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 61/79] blkdebug: Catch bs->exact_filename overflow, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 42/79] blkdebug: Add ability to override unmap geometries, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 40/79] blkdebug: Add pass-through write_zero and discard support, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 45/79] block: Guarantee that *file is set on bdrv_get_block_status(), Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 47/79] virtio-serial-bus: Unset hotplug handler when unrealize, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 50/79] monitor: fix object_del for command-line-created objects, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 65/79] 9pfs: local: remove: use correct path component, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 04/79] qemu-img/convert: Use @opts for one thing only, Michael Roth, 2017/08/28
- [Qemu-devel] [PATCH 56/79] target/xtensa: handle unknown registers in gdbstub, Michael Roth, 2017/08/28