Bug 194128 - CTL frontend possible race, missing ccb completion
Summary: CTL frontend possible race, missing ccb completion
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Alexander Motin
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-03 23:17 UTC by Scott M. Ferris
Modified: 2014-10-09 05:28 UTC (History)
1 user (show)

See Also:

Attachments
ctl_frontend_cam_sim patch (762 bytes, patch)
2014-10-03 23:17 UTC, Scott M. Ferris 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Scott M. Ferris 2014-10-03 23:17:01 UTC 
Created attachment 147952 [details]
ctl_frontend_cam_sim patch

While hunting some memory use-after-free bugs involving CAM_SIM_QUEUED being set on a freed ccb, I found what looks like a possible race where the CTL frontend can queue a ccb for processing before setting the CAM_SIM_QUEUED flag.

CTL also seems to be missing a ccb completion in the case where the ccb couldn't be queued.

Patch attached.
Comment 1 Benno Rice freebsd_committer freebsd_triage 2014-10-04 00:00:30 UTC 
When this is committed it should be marked as sponsored by EMC/Isilon Storage Division.
Comment 2 commit-hook freebsd_committer freebsd_triage 2014-10-06 14:53:05 UTC 
A commit references this bug:

Author: mav
Date: Mon Oct  6 14:52:05 UTC 2014
New revision: 272650
URL: https://svnweb.freebsd.org/changeset/base/272650

Log:
  Set CAM_SIM_QUEUED flag before calling ctl_queue() to avoid race.

  PR:		194128
  Submitted by:	Scott M. Ferris <smferris@gmail.com>
  MFC after:	3 days
  Sponsored by:	EMC/Isilon Storage Division

Changes:
  head/sys/cam/ctl/ctl_frontend_cam_sim.c
Comment 3 Alexander Motin freebsd_committer freebsd_triage 2014-10-06 14:54:01 UTC 
Looks good to me. Committed to FreeBSD head. Thank you.
Comment 4 commit-hook freebsd_committer freebsd_triage 2014-10-09 05:28:34 UTC 
A commit references this bug:

Author: mav
Date: Thu Oct  9 05:28:12 UTC 2014
New revision: 272798
URL: https://svnweb.freebsd.org/changeset/base/272798

Log:
  MFC r272650: Set CAM_SIM_QUEUED flag before calling ctl_queue() to avoid race.

  PR:		194128
  Submitted by:	Scott M. Ferris <smferris@gmail.com>
  Sponsored by:	EMC/Isilon Storage Division

Changes:
_U  stable/10/
  stable/10/sys/cam/ctl/ctl_frontend_cam_sim.c