From: Jia Jia <[email protected]>
ufs_init_scsi_device() creates an internal scsi-hd and adds it as a
child of lu->bus. qdev_realize_and_unref() then drops the construction
reference, leaving the bus child ownership to tear it down.
ufs_lu_unrealize() still unrefs lu->scsi_dev directly. If the UFS
controller is ejected through ACPI PCI hotplug, the scsi-hd object can be
finalized there and then the bus child removal RCU callback later unrefs
the same object again.
Keep lu->scsi_dev as a borrowed pointer and clear it during unrealize
without unreffing it.
Add a qtest that ejects the UFS controller through the x86 ACPI PCI
hotplug eject register. On an ASAN build, the test reproduces the UAF
before the fix.
Fixes: 096434fea13a ("hw/ufs: Modify lu.c to share codes with SCSI subsystem")
Cc: [email protected]
Signed-off-by: Jia Jia <[email protected]>
Signed-off-by: Jeuk Kim <[email protected]>
(cherry picked from commit 90aacd5bc405cb71f77472616093f9e5ad9afd2b)
(Mjt: tests/qtest/ufs-test.c: context fixup)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c
index 709d6adcf68..ebaf979313e 100644
--- a/hw/ufs/lu.c
+++ b/hw/ufs/lu.c
@@ -416,10 +416,7 @@ static void ufs_lu_unrealize(DeviceState *dev)
{
UfsLu *lu = DO_UPCAST(UfsLu, qdev, dev);
- if (lu->scsi_dev) {
- object_unref(OBJECT(lu->scsi_dev));
- lu->scsi_dev = NULL;
- }
+ lu->scsi_dev = NULL;
}
static void ufs_lu_class_init(ObjectClass *oc, const void *data)
diff --git a/tests/qtest/ufs-test.c b/tests/qtest/ufs-test.c
index 7f999441552..564202e5849 100644
--- a/tests/qtest/ufs-test.c
+++ b/tests/qtest/ufs-test.c
@@ -34,6 +34,8 @@
#define TEST_QID 0
#define QUEUE_SIZE 32
#define UFS_MCQ_MAX_QNUM 32
+#define ACPI_PCIHP_ADDR 0xae00
+#define PCI_EJ_BASE 0x0008
typedef struct QUfs QUfs;
@@ -635,6 +637,17 @@ static void ufstest_reg_read(void *obj, void *data,
QGuestAllocator *alloc)
qpci_iounmap(&ufs->dev, ufs->bar);
}
+static void ufstest_acpi_eject(void *obj, void *data, QGuestAllocator *alloc)
+{
+ QUfs *ufs = obj;
+ QTestState *qts = ufs->dev.bus->qts;
+
+ qtest_outl(qts, ACPI_PCIHP_ADDR + PCI_EJ_BASE, 1 << 4);
+ qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }");
+ g_usleep(3 * G_USEC_PER_SEC);
+ qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }");
+}
+
static void ufstest_init(void *obj, void *data, QGuestAllocator *alloc)
{
QUfs *ufs = obj;
@@ -1234,6 +1247,8 @@ static void ufs_register_nodes(void)
.edge.extra_device_opts =
"mcq=true,mcq-maxq=1" };
+ QOSGraphTestOptions acpi_eject_test_opts = { .subprocess = true };
+
add_qpci_address(&edge_opts, &(QPCIAddress){ .devfn = QPCI_DEVFN(4, 0) });
qos_node_create_driver("ufs", ufs_create);
@@ -1251,6 +1266,10 @@ static void ufs_register_nodes(void)
g_test_message("Skipping ufs io tests for ppc64");
return;
}
+ if (!strcmp(arch, "i386") || !strcmp(arch, "x86_64")) {
+ qos_add_test("acpi-eject", "ufs", ufstest_acpi_eject,
+ &acpi_eject_test_opts);
+ }
qos_add_test("init", "ufs", ufstest_init, NULL);
qos_add_test("legacy-read-write", "ufs", ufstest_read_write,
&io_test_opts);
qos_add_test("mcq-read-write", "ufs", ufstest_read_write, &mcq_test_opts);
--
2.47.3
