diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2023-02-21 16:22:16 -0500 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2023-02-23 19:49:35 +0100 |
| commit | 7b7fc3d0102dafe8eb44802493036a526e921a71 (patch) | |
| tree | 1e8919c4735b7e602accbaac7e6cfa5400f504aa /module-common.c | |
| parent | 8ab8140a04cf771d63e9754d6ba6c1e676bfe507 (diff) | |
| download | qemu-7b7fc3d0102dafe8eb44802493036a526e921a71.zip qemu-7b7fc3d0102dafe8eb44802493036a526e921a71.tar.gz qemu-7b7fc3d0102dafe8eb44802493036a526e921a71.tar.bz2 | |
scsi: protect req->aiocb with AioContext lock
If requests are being processed in the IOThread when a SCSIDevice is
unplugged, scsi_device_purge_requests() -> scsi_req_cancel_async() races
with I/O completion callbacks. Both threads load and store req->aiocb.
This can lead to assert(r->req.aiocb == NULL) failures and undefined
behavior.
Protect r->req.aiocb with the AioContext lock to prevent the race.
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230221212218.1378734-2-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'module-common.c')
0 files changed, 0 insertions, 0 deletions