ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

blockjob: update nodes head while removing all bdrv 

block_job_remove_all_bdrv() iterates through job->nodes, calling
bdrv_root_unref_child() for each entry. The call to the latter may
reach child_job_[can_]set_aio_ctx(), which will also attempt to
traverse job->nodes, potentially finding entries that where freed
on previous iterations.

To avoid this situation, update job->nodes head on each iteration to
ensure that already freed entries are no longer linked to the list.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1746631
Signed-off-by: Sergio Lopez <slp@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-id: 20190911100316.32282-1-mreitz@redhat.com
Reviewed-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
This commit is contained in:
Sergio Lopez 2019-09-11 12:03:16 +02:00 committed by Max Reitz
parent c34dc07f9f
commit d876bf676f
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
blockjob.c
View File

@ -175,14 +175,23 @@ static const BdrvChildRole child_job = {
void block_job_remove_all_bdrv(BlockJob *job) void block_job_remove_all_bdrv(BlockJob *job)
{ {
GSList *l; /*
for (l = job->nodes; l; l = l->next) { * bdrv_root_unref_child() may reach child_job_[can_]set_aio_ctx(),
* which will also traverse job->nodes, so consume the list one by
* one to make sure that such a concurrent access does not attempt
* to process an already freed BdrvChild.
*/
while (job->nodes) {
GSList *l = job->nodes;
BdrvChild *c = l->data; BdrvChild *c = l->data;
job->nodes = l->next;
bdrv_op_unblock_all(c->bs, job->blocker); bdrv_op_unblock_all(c->bs, job->blocker);
bdrv_root_unref_child(c); bdrv_root_unref_child(c);
g_slist_free_1(l);
} }
g_slist_free(job->nodes);
job->nodes = NULL;
} }
bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs) bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs)