ab7fc8ee5b
- target/i386: Introduce SapphireRapids-v3 to add missing features - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level - target/arm: Fix alignment for VLD4.32 - hw/microblaze: pass random seed to fdt - tests/qtest: npcm7xx-emc-test: Skip checking MAC - tests: mark io-command test as skipped if socat is missing - tests: unit: add NULL-pointer check - tests: test-qga: close socket on failure to connect - vdpa:block device capacity expansion online support vdpa block device update capacity. - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505) - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server - ppc/vof: Fix unaligned FDT property access - vvfat: Fix reading files with non-continuous clusters - vvfat: Fix bug in writing to middle of file - savevm: Fix load_snapshot error path crash - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma - hw/remote/message.c: Don't directly invoke DeviceClass:reset - crypto/tlscredspsk: Free username on finalize - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read() - virtio: remove virtio_tswap16s() call in vring_packed_event_read() - char-stdio: Restore blocking mode of stdout on exit - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab - smbios: sanitize type from external type before checking have_fields_bitmap - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code - KVM: use store-release to mark dirty pages as harvested - monitor/hmp: print trace as option in help for log command - tpm_crb: Avoid backend startup just before shutdown under Xen - crypto/block-luks: make range overlap check more readable - spapr: Free stdout path - target/rx: Use target_ulong for address in LI - virtio-pci: Fix the use of an uninitialized irqfd - rtl8139: Fix behaviour for old kernels. - virtio-rng: block max-bytes=0 MIME-Version: 1.0 - hw/audio/es1370: Clean up comment - vhost-user-server: do not set memory fd non-blocking - ui: reject extended clipboard message if not activated - virtio-net: Fix vhost virtqueue notifiers for RSS - hw/misc/applesmc: Fix memory leak in reset() handler Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit db7a5d9a7239db307c8c1454fab5f8a92fd486b8)
91 lines
3.1 KiB
Diff
91 lines
3.1 KiB
Diff
From fa58315ae2b81ea8b5b352bf19ff6bc1d3a4c684 Mon Sep 17 00:00:00 2001
|
|
From: Eric Blake <eblake@redhat.com>
|
|
Date: Thu, 22 Aug 2024 09:35:29 -0500
|
|
Subject: [PATCH] nbd/server: CVE-2024-7409: Avoid use-after-free when closing
|
|
server
|
|
|
|
Commit 3e7ef738 plugged the use-after-free of the global nbd_server
|
|
object, but overlooked a use-after-free of nbd_server->listener.
|
|
Although this race is harder to hit, notice that our shutdown path
|
|
first drops the reference count of nbd_server->listener, then triggers
|
|
actions that can result in a pending client reaching the
|
|
nbd_blockdev_client_closed() callback, which in turn calls
|
|
qio_net_listener_set_client_func on a potentially stale object.
|
|
|
|
If we know we don't want any more clients to connect, and have already
|
|
told the listener socket to shut down, then we should not be trying to
|
|
update the listener socket's associated function.
|
|
|
|
Reproducer:
|
|
|
|
> #!/usr/bin/python3
|
|
>
|
|
> import os
|
|
> from threading import Thread
|
|
>
|
|
> def start_stop():
|
|
> while 1:
|
|
> os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-start",
|
|
+"arguments":{"addr":{"type":"unix","data":{"path":"/tmp/nbd-sock"}}}}\'')
|
|
> os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-stop"}\'')
|
|
>
|
|
> def nbd_list():
|
|
> while 1:
|
|
> os.system('/path/to/build/qemu-nbd -L -k /tmp/nbd-sock')
|
|
>
|
|
> def test():
|
|
> sst = Thread(target=start_stop)
|
|
> sst.start()
|
|
> nlt = Thread(target=nbd_list)
|
|
> nlt.start()
|
|
>
|
|
> sst.join()
|
|
> nlt.join()
|
|
>
|
|
> test()
|
|
|
|
Fixes: CVE-2024-7409
|
|
Fixes: 3e7ef738c8 ("nbd/server: CVE-2024-7409: Close stray clients at server-stop")
|
|
CC: qemu-stable@nongnu.org
|
|
Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
|
|
Signed-off-by: Eric Blake <eblake@redhat.com>
|
|
Message-ID: <20240822143617.800419-2-eblake@redhat.com>
|
|
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
---
|
|
blockdev-nbd.c | 12 ++++++++----
|
|
1 file changed, 8 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/blockdev-nbd.c b/blockdev-nbd.c
|
|
index c71ca38d29..94e9eddc3c 100644
|
|
--- a/blockdev-nbd.c
|
|
+++ b/blockdev-nbd.c
|
|
@@ -87,10 +87,13 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
|
|
|
|
static void nbd_update_server_watch(NBDServerData *s)
|
|
{
|
|
- if (!s->max_connections || s->connections < s->max_connections) {
|
|
- qio_net_listener_set_client_func(s->listener, nbd_accept, NULL, NULL);
|
|
- } else {
|
|
- qio_net_listener_set_client_func(s->listener, NULL, NULL, NULL);
|
|
+ if (s->listener) {
|
|
+ if (!s->max_connections || s->connections < s->max_connections) {
|
|
+ qio_net_listener_set_client_func(s->listener, nbd_accept, NULL,
|
|
+ NULL);
|
|
+ } else {
|
|
+ qio_net_listener_set_client_func(s->listener, NULL, NULL, NULL);
|
|
+ }
|
|
}
|
|
}
|
|
|
|
@@ -108,6 +111,7 @@ static void nbd_server_free(NBDServerData *server)
|
|
*/
|
|
qio_net_listener_disconnect(server->listener);
|
|
object_unref(OBJECT(server->listener));
|
|
+ server->listener = NULL;
|
|
QLIST_FOREACH_SAFE(conn, &server->conns, next, tmp) {
|
|
qio_channel_shutdown(QIO_CHANNEL(conn->cioc), QIO_CHANNEL_SHUTDOWN_BOTH,
|
|
NULL);
|
|
--
|
|
2.41.0.windows.1
|
|
|