[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v5 9/9] scsi/scsi_bus: fix races in REPORT LUNS
From: |
Maxim Levitsky |
Subject: |
[PATCH v5 9/9] scsi/scsi_bus: fix races in REPORT LUNS |
Date: |
Sun, 13 Sep 2020 19:02:59 +0300 |
Currently scsi_target_emulate_report_luns iterates over the child device list
twice, and there is no guarantee that this list is the same in both iterations.
The reason for iterating twise is that the first iteration calculates
how much memory to allocate.
However if we use a dynamic array we can avoid iterating twice, and therefore
we avoid this race.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1866707
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
hw/scsi/scsi-bus.c | 65 ++++++++++++++++++++++------------------------
1 file changed, 31 insertions(+), 34 deletions(-)
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index dfd503f7ef..84c145c724 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -439,19 +439,23 @@ struct SCSITargetReq {
static void store_lun(uint8_t *outbuf, int lun)
{
if (lun < 256) {
+ /* Simple logical unit addressing method*/
+ outbuf[0] = 0;
outbuf[1] = lun;
- return;
+ } else {
+ /* Flat space addressing method */
+ outbuf[0] = 0x40 | (lun >> 8);
+ outbuf[1] = (lun & 255);
}
- outbuf[1] = (lun & 255);
- outbuf[0] = (lun >> 8) | 0x40;
}
static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
{
BusChild *kid;
- int i, len, n;
int channel, id;
- bool found_lun0;
+ uint8_t tmp[8] = {0};
+ int len = 0;
+ GByteArray *buf;
if (r->req.cmd.xfer < 16) {
return false;
@@ -459,48 +463,41 @@ static bool scsi_target_emulate_report_luns(SCSITargetReq
*r)
if (r->req.cmd.buf[2] > 2) {
return false;
}
+
+ /* reserve space for 63 LUNs*/
+ buf = g_byte_array_sized_new(512);
+
channel = r->req.dev->channel;
id = r->req.dev->id;
- found_lun0 = false;
- n = 0;
- rcu_read_lock();
+ /* add size (will be updated later to correct value */
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
- QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) {
- DeviceState *qdev = kid->child;
- SCSIDevice *dev = SCSI_DEVICE(qdev);
+ /* add LUN0 */
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
- if (dev->channel == channel && dev->id == id) {
- if (dev->lun == 0) {
- found_lun0 = true;
- }
- n += 8;
- }
- }
- if (!found_lun0) {
- n += 8;
- }
-
- scsi_target_alloc_buf(&r->req, n + 8);
-
- len = MIN(n + 8, r->req.cmd.xfer & ~7);
- memset(r->buf, 0, len);
- stl_be_p(&r->buf[0], n);
- i = found_lun0 ? 8 : 16;
+ rcu_read_lock();
QTAILQ_FOREACH_RCU(kid, &r->req.bus->qbus.children, sibling) {
DeviceState *qdev = kid->child;
SCSIDevice *dev = SCSI_DEVICE(qdev);
- if (dev->channel == channel && dev->id == id) {
- store_lun(&r->buf[i], dev->lun);
- i += 8;
+ if (dev->channel == channel && dev->id == id && dev->lun != 0) {
+ store_lun(tmp, dev->lun);
+ g_byte_array_append(buf, tmp, 8);
+ len += 8;
}
}
-
rcu_read_unlock();
- assert(i == n + 8);
- r->len = len;
+ r->buf_len = len;
+ r->buf = g_byte_array_free(buf, FALSE);
+ r->len = MIN(len, r->req.cmd.xfer & ~7);
+
+ /* store the LUN list length */
+ stl_be_p(&r->buf[0], len - 8);
+
return true;
}
--
2.26.2
- [PATCH v5 0/9] Fix scsi devices plug/unplug races w.r.t virtio-scsi iothread, Maxim Levitsky, 2020/09/13
- [PATCH v5 1/9] scsi/scsi_bus: switch search direction in scsi_device_find, Maxim Levitsky, 2020/09/13
- [PATCH v5 2/9] rcu: Implement drain_call_rcu, Maxim Levitsky, 2020/09/13
- [PATCH v5 3/9] device_core: use drain_call_rcu in in hmp_device_del/qmp_device_add, Maxim Levitsky, 2020/09/13
- [PATCH v5 4/9] device-core: use RCU for list of childs of a bus, Maxim Levitsky, 2020/09/13
- [PATCH v5 5/9] device-core: use atomic_set on .realized property, Maxim Levitsky, 2020/09/13
- [PATCH v5 6/9] scsi/scsi-bus: scsi_device_find: don't return unrealized devices, Maxim Levitsky, 2020/09/13
- [PATCH v5 7/9] scsi/scsi_bus: Add scsi_device_get, Maxim Levitsky, 2020/09/13
- [PATCH v5 8/9] virtio-scsi: use scsi_device_get, Maxim Levitsky, 2020/09/13
- [PATCH v5 9/9] scsi/scsi_bus: fix races in REPORT LUNS,
Maxim Levitsky <=