block: Fix use after free in blockdev_mark_auto_del()
commite2626874a32602d4e52971c786ef5ffb4430629d
authorKevin Wolf <kwolf@redhat.com>
Wed, 3 May 2023 14:01:42 +0000 (3 16:01 +0200)
committerKevin Wolf <kwolf@redhat.com>
Wed, 10 May 2023 12:16:35 +0000 (10 14:16 +0200)
tree0e7531062aa0b37161318422918325c298c4bdf9
parent3edf660a9155848d1d7bc6ad2586ceb0285105e3
block: Fix use after free in blockdev_mark_auto_del()

job_cancel_locked() drops the job list lock temporarily and it may call
aio_poll(). We must assume that the list has changed after this call.
Also, with unlucky timing, it can end up freeing the job during
job_completed_txn_abort_locked(), making the job pointer invalid, too.

For both reasons, we can't just continue at block_job_next_locked(job).
Instead, start at the head of the list again after job_cancel_locked()
and skip those jobs that we already cancelled (or that are completing
anyway).

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20230503140142.474404-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
blockdev.c