diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2011-06-07 17:51:21 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2011-06-15 15:43:20 +0200 |
| commit | 7887f6201ff3fdc9a142eba14d61c563adb57596 (patch) | |
| tree | d73ada91776eaaf7f87424c6514b0eeab7c1b31a | |
| parent | ee752da74f5d07cf441f8d42455c4241d6051ae5 (diff) | |
| download | focaccia-qemu-7887f6201ff3fdc9a142eba14d61c563adb57596.tar.gz focaccia-qemu-7887f6201ff3fdc9a142eba14d61c563adb57596.zip | |
Allow nested qemu_bh_poll() after BH deletion
Without this, qemu segfaults when a BH handler first deletes its BH and then calls another function which involves a nested qemu_bh_poll() call. This can be reproduced by generating an I/O error (e.g. with blkdebug) on an IDE device and using rerror/werror=stop to stop the VM. When continuing the VM, qemu segfaults. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
| -rw-r--r-- | async.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/async.c b/async.c index 57ac3a8180..fd313dffb7 100644 --- a/async.c +++ b/async.c @@ -137,11 +137,12 @@ QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque) int qemu_bh_poll(void) { - QEMUBH *bh, **bhp; + QEMUBH *bh, **bhp, *next; int ret; ret = 0; - for (bh = async_context->first_bh; bh; bh = bh->next) { + for (bh = async_context->first_bh; bh; bh = next) { + next = bh->next; if (!bh->deleted && bh->scheduled) { bh->scheduled = 0; if (!bh->idle) |