Re: [PATCH v3] virtio-blk: handle block_device_operations callbacks after hot unplug

2020-04-30 Thread Stefano Garzarella
On Thu, Apr 30, 2020 at 06:28:21AM -0400, Michael S. Tsirkin wrote: > On Thu, Apr 30, 2020 at 11:14:10AM +0100, Stefan Hajnoczi wrote: > > On Thu, Apr 30, 2020 at 10:43:23AM +0200, Stefano Garzarella wrote: > > > On Wed, Apr 29, 2020 at 05:53:45PM +0100, Stefan Hajnoczi wrote: > > > > A userspace p

Re: [PATCH v3] virtio-blk: handle block_device_operations callbacks after hot unplug

2020-04-30 Thread Michael S. Tsirkin
On Thu, Apr 30, 2020 at 11:14:10AM +0100, Stefan Hajnoczi wrote: > On Thu, Apr 30, 2020 at 10:43:23AM +0200, Stefano Garzarella wrote: > > On Wed, Apr 29, 2020 at 05:53:45PM +0100, Stefan Hajnoczi wrote: > > > A userspace process holding a file descriptor to a virtio_blk device can > > > still invo

Re: [PATCH v3] virtio-blk: handle block_device_operations callbacks after hot unplug

2020-04-30 Thread Stefan Hajnoczi
On Thu, Apr 30, 2020 at 10:43:23AM +0200, Stefano Garzarella wrote: > On Wed, Apr 29, 2020 at 05:53:45PM +0100, Stefan Hajnoczi wrote: > > A userspace process holding a file descriptor to a virtio_blk device can > > still invoke block_device_operations after hot unplug. This leads to a > > use-aft

Re: [PATCH v3] virtio-blk: handle block_device_operations callbacks after hot unplug

2020-04-30 Thread Stefano Garzarella
On Wed, Apr 29, 2020 at 05:53:45PM +0100, Stefan Hajnoczi wrote: > A userspace process holding a file descriptor to a virtio_blk device can > still invoke block_device_operations after hot unplug. This leads to a > use-after-free accessing vblk->vdev in virtblk_getgeo() when > ioctl(HDIO_GETGEO) i

[PATCH v3] virtio-blk: handle block_device_operations callbacks after hot unplug

2020-04-29 Thread Stefan Hajnoczi
A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked: BUG: unable to handle kernel NULL pointer dereference at 00