Both blockdev.c and job-qmp.c have TOC/TOU conditions, because
they first search for the job and then perform an action on it.
Therefore, we need to do the search + action under the same
job mutex critical section.
Note: at this stage, job_{lock/unlock} and job lock guard macros
are *nop*.
Signed-off-by: Emanuele Giuseppe Esposito <eespo...@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru>
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
Reviewed-by: Kevin Wolf <kw...@redhat.com>
---
blockdev.c | 67 +++++++++++++++++++++++++++++++++++++-----------------
job-qmp.c | 57 ++++++++++++++++++++++++++++++++--------------
2 files changed, 86 insertions(+), 38 deletions(-)
diff --git a/blockdev.c b/blockdev.c
index 392d9476e6..2e941e2979 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3313,9 +3313,13 @@ out:
aio_context_release(aio_context);
}
-/* Get a block job using its ID and acquire its AioContext */
-static BlockJob *find_block_job(const char *id, AioContext **aio_context,
- Error **errp)
+/*
+ * Get a block job using its ID and acquire its AioContext.
+ * Called with job_mutex held.
+ */
+static BlockJob *find_block_job_locked(const char *id,
+ AioContext **aio_context,
+ Error **errp)
{
BlockJob *job;
@@ -3323,7 +3327,7 @@ static BlockJob *find_block_job(const char *id,
AioContext **aio_context,
*aio_context = NULL;
- job = block_job_get(id);
+ job = block_job_get_locked(id);
if (!job) {
error_set(errp, ERROR_CLASS_DEVICE_NOT_ACTIVE,
@@ -3340,13 +3344,16 @@ static BlockJob *find_block_job(const char *id,
AioContext **aio_context,
void qmp_block_job_set_speed(const char *device, int64_t speed, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(device, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(device, &aio_context, errp);
if (!job) {
return;
}
- block_job_set_speed(job, speed, errp);
+ block_job_set_speed_locked(job, speed, errp);
aio_context_release(aio_context);
}
@@ -3354,7 +3361,10 @@ void qmp_block_job_cancel(const char *device,
bool has_force, bool force, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(device, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(device, &aio_context, errp);
if (!job) {
return;
@@ -3364,14 +3374,14 @@ void qmp_block_job_cancel(const char *device,
force = false;
}
- if (job_user_paused(&job->job) && !force) {
+ if (job_user_paused_locked(&job->job) && !force) {
error_setg(errp, "The block job for device '%s' is currently paused",
device);
goto out;
}
trace_qmp_block_job_cancel(job);
- job_user_cancel(&job->job, force, errp);
+ job_user_cancel_locked(&job->job, force, errp);
out:
aio_context_release(aio_context);
}
@@ -3379,57 +3389,69 @@ out:
void qmp_block_job_pause(const char *device, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(device, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(device, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_block_job_pause(job);
- job_user_pause(&job->job, errp);
+ job_user_pause_locked(&job->job, errp);
aio_context_release(aio_context);
}
void qmp_block_job_resume(const char *device, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(device, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(device, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_block_job_resume(job);
- job_user_resume(&job->job, errp);
+ job_user_resume_locked(&job->job, errp);
aio_context_release(aio_context);
}
void qmp_block_job_complete(const char *device, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(device, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(device, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_block_job_complete(job);
- job_complete(&job->job, errp);
+ job_complete_locked(&job->job, errp);
aio_context_release(aio_context);
}
void qmp_block_job_finalize(const char *id, Error **errp)
{
AioContext *aio_context;
- BlockJob *job = find_block_job(id, &aio_context, errp);
+ BlockJob *job;
+
+ JOB_LOCK_GUARD();
+ job = find_block_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_block_job_finalize(job);
- job_ref(&job->job);
- job_finalize(&job->job, errp);
+ job_ref_locked(&job->job);
+ job_finalize_locked(&job->job, errp);
/*
* Job's context might have changed via job_finalize (and job_txn_apply
@@ -3437,23 +3459,26 @@ void qmp_block_job_finalize(const char *id, Error
**errp)
* one.
*/
aio_context = block_job_get_aio_context(job);
- job_unref(&job->job);
+ job_unref_locked(&job->job);
aio_context_release(aio_context);
}
void qmp_block_job_dismiss(const char *id, Error **errp)
{
AioContext *aio_context;
- BlockJob *bjob = find_block_job(id, &aio_context, errp);
+ BlockJob *bjob;
Job *job;
+ JOB_LOCK_GUARD();
+ bjob = find_block_job_locked(id, &aio_context, errp);
+
if (!bjob) {
return;
}
trace_qmp_block_job_dismiss(bjob);
job = &bjob->job;
- job_dismiss(&job, errp);
+ job_dismiss_locked(&job, errp);
aio_context_release(aio_context);
}
diff --git a/job-qmp.c b/job-qmp.c
index 829a28aa70..b1c456482a 100644
--- a/job-qmp.c
+++ b/job-qmp.c
@@ -29,14 +29,19 @@
#include "qapi/error.h"
#include "trace/trace-root.h"
-/* Get a job using its ID and acquire its AioContext */
-static Job *find_job(const char *id, AioContext **aio_context, Error **errp)
+/*
+ * Get a job using its ID and acquire its AioContext.
+ * Called with job_mutex held.
+ */
+static Job *find_job_locked(const char *id,
+ AioContext **aio_context,
+ Error **errp)
{
Job *job;
*aio_context = NULL;
- job = job_get(id);
+ job = job_get_locked(id);
if (!job) {
error_setg(errp, "Job not found");
return NULL;
@@ -51,71 +56,86 @@ static Job *find_job(const char *id, AioContext
**aio_context, Error **errp)
void qmp_job_cancel(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_cancel(job);
- job_user_cancel(job, true, errp);
+ job_user_cancel_locked(job, true, errp);
aio_context_release(aio_context);
}
void qmp_job_pause(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_pause(job);
- job_user_pause(job, errp);
+ job_user_pause_locked(job, errp);
aio_context_release(aio_context);
}
void qmp_job_resume(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_resume(job);
- job_user_resume(job, errp);
+ job_user_resume_locked(job, errp);
aio_context_release(aio_context);
}
void qmp_job_complete(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_complete(job);
- job_complete(job, errp);
+ job_complete_locked(job, errp);
aio_context_release(aio_context);
}
void qmp_job_finalize(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_finalize(job);
- job_ref(job);
- job_finalize(job, errp);
+ job_ref_locked(job);
+ job_finalize_locked(job, errp);
/*
* Job's context might have changed via job_finalize (and job_txn_apply
@@ -123,21 +143,24 @@ void qmp_job_finalize(const char *id, Error **errp)
* one.
*/
aio_context = job->aio_context;
- job_unref(job);
+ job_unref_locked(job);
aio_context_release(aio_context);
}
void qmp_job_dismiss(const char *id, Error **errp)
{
AioContext *aio_context;
- Job *job = find_job(id, &aio_context, errp);
+ Job *job;
+
+ JOB_LOCK_GUARD();
+ job = find_job_locked(id, &aio_context, errp);
if (!job) {
return;
}
trace_qmp_job_dismiss(job);
- job_dismiss(&job, errp);
+ job_dismiss_locked(&job, errp);
aio_context_release(aio_context);
}
--
2.31.1
