From d88a4ac57a9107f5fc764dc33426354dafe70165 Mon Sep 17 00:00:00 2001 From: Adam Rutkowski Date: Fri, 5 Apr 2019 13:58:10 -0400 Subject: [PATCH] Do not allow top volume I/O on management queue Core volume I/O must not be queued on management queue - this would break I/O accounting code, resulting in use-after-free type of errors after cache detach, core remove etc. Signed-off-by: Adam Rutkowski --- src/ocf_core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/ocf_core.c b/src/ocf_core.c index ba3a69e..47c3ee0 100644 --- a/src/ocf_core.c +++ b/src/ocf_core.c @@ -196,6 +196,12 @@ static inline int ocf_core_validate_io(struct ocf_io *io) if (!io->end) return -EINVAL; + /* Core volume I/O must not be queued on management queue - this would + * break I/O accounting code, resulting in use-after-free type of errors + * after cache detach, core remove etc. */ + if (io->io_queue == io->volume->cache->mngt_queue) + return -EINVAL; + return 0; } @@ -226,7 +232,7 @@ void ocf_core_submit_io_mode(struct ocf_io *io, ocf_cache_mode_t cache_mode) ret = ocf_core_validate_io(io); if (ret < 0) { - io->end(io, -EINVAL); + io->end(io, ret); return; } @@ -400,7 +406,7 @@ static void ocf_core_volume_submit_flush(struct ocf_io *io) ret = ocf_core_validate_io(io); if (ret < 0) { - ocf_io_end(io, -EINVAL); + ocf_io_end(io, ret); return; } @@ -442,7 +448,7 @@ static void ocf_core_volume_submit_discard(struct ocf_io *io) ret = ocf_core_validate_io(io); if (ret < 0) { - ocf_io_end(io, -EINVAL); + ocf_io_end(io, ret); return; }