diff options
| author | Fam Zheng <famz@redhat.com> | 2017-04-18 22:30:43 +0800 |
|---|---|---|
| committer | Fam Zheng <famz@redhat.com> | 2017-04-18 22:56:28 +0800 |
| commit | 178bd438af5c95deef5073416c60396f88e97ec9 (patch) | |
| tree | e6637a6b80a892746126e6270dc009466fc64885 /qemu-options.hx | |
| parent | 9c6b899f7a46893ab3b671e341a2234e9c0c060e (diff) | |
| download | qemu-178bd438af5c95deef5073416c60396f88e97ec9.zip qemu-178bd438af5c95deef5073416c60396f88e97ec9.tar.gz qemu-178bd438af5c95deef5073416c60396f88e97ec9.tar.bz2 | |
block: Walk bs->children carefully in bdrv_drain_recurse
The recursive bdrv_drain_recurse may run a block job completion BH that
drops nodes. The coming changes will make that more likely and use-after-free
would happen without this patch
Stash the bs pointer and use bdrv_ref/bdrv_unref in addition to
QLIST_FOREACH_SAFE to prevent such a case from happening.
Since bdrv_unref accesses global state that is not protected by the AioContext
lock, we cannot use bdrv_ref/bdrv_unref unconditionally. Fortunately the
protection is not needed in IOThread because only main loop can modify a graph
with the AioContext lock held.
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170418143044.12187-2-famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Tested-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Diffstat (limited to 'qemu-options.hx')
0 files changed, 0 insertions, 0 deletions