On Thu, Aug 22, 2024 at 09:35:29AM -0500, Eric Blake wrote:
> Commit 3e7ef738 plugged the use-after-free of the global nbd_server
> object, but overlooked a use-after-free of nbd_server->listener.
> Although this race is harder to hit, notice that our shutdown path
> first drops the reference count of nbd_server->listener, then triggers
> actions that can result in a pending client reaching the
> nbd_blockdev_client_closed() callback, which in turn calls
> qio_net_listener_set_client_func on a potentially stale object.
>
> If we know we don't want any more clients to connect, and have already
> told the listener socket to shut down, then we should not be trying to
> update the listener socket's associated function.
>
> Reproducer:
>
> > #!/usr/bin/python3
> >
> > import os
> > from threading import Thread
> >
> > def start_stop():
> > while 1:
> > os.system('virsh qemu-monitor-command VM \'{"execute":
> > "nbd-server-start",
> +"arguments":{"addr":{"type":"unix","data":{"path":"/tmp/nbd-sock"}}}}\'')
> > os.system('virsh qemu-monitor-command VM \'{"execute":
> > "nbd-server-stop"}\'')
> >
> > def nbd_list():
> > while 1:
> > os.system('/path/to/build/qemu-nbd -L -k /tmp/nbd-sock')
> >
> > def test():
> > sst = Thread(target=start_stop)
> > sst.start()
> > nlt = Thread(target=nbd_list)
> > nlt.start()
> >
> > sst.join()
> > nlt.join()
> >
> > test()
>
> Fixes: CVE-2024-7409
> Fixes: 3e7ef738c8 ("nbd/server: CVE-2024-7409: Close stray clients at
> server-stop")
> CC: qemu-sta...@nongnu.org
> Reported-by: Andrey Drobyshev <andrey.drobys...@virtuozzo.com>
> Signed-off-by: Eric Blake <ebl...@redhat.com>
> ---
> blockdev-nbd.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
signature.asc
Description: PGP signature
