Re: [PATCH for-9.1] nbd/server: CVE-2024-7409: Avoid use-after-free when closing server

[Stefan Hajnoczi <stefanha@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1872 bytes --]

On Thu, Aug 22, 2024 at 09:35:29AM -0500, Eric Blake wrote:
> Commit 3e7ef738 plugged the use-after-free of the global nbd_server
> object, but overlooked a use-after-free of nbd_server->listener.
> Although this race is harder to hit, notice that our shutdown path
> first drops the reference count of nbd_server->listener, then triggers
> actions that can result in a pending client reaching the
> nbd_blockdev_client_closed() callback, which in turn calls
> qio_net_listener_set_client_func on a potentially stale object.
> 
> If we know we don't want any more clients to connect, and have already
> told the listener socket to shut down, then we should not be trying to
> update the listener socket's associated function.
> 
> Reproducer:
> 
> > #!/usr/bin/python3
> >
> > import os
> > from threading import Thread
> >
> > def start_stop():
> >     while 1:
> >         os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-start",
> +"arguments":{"addr":{"type":"unix","data":{"path":"/tmp/nbd-sock"}}}}\'')
> >         os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-stop"}\'')
> >
> > def nbd_list():
> >     while 1:
> >         os.system('/path/to/build/qemu-nbd -L -k /tmp/nbd-sock')
> >
> > def test():
> >     sst = Thread(target=start_stop)
> >     sst.start()
> >     nlt = Thread(target=nbd_list)
> >     nlt.start()
> >
> >     sst.join()
> >     nlt.join()
> >
> > test()
> 
> Fixes: CVE-2024-7409
> Fixes: 3e7ef738c8 ("nbd/server: CVE-2024-7409: Close stray clients at server-stop")
> CC: qemu-stable@nongnu.org
> Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
> Signed-off-by: Eric Blake <eblake@redhat.com>
> ---
>  blockdev-nbd.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]