diff options
| author | Fam Zheng <famz@redhat.com> | 2017-04-18 22:30:43 +0800 |
|---|---|---|
| committer | Fam Zheng <famz@redhat.com> | 2017-04-18 22:56:28 +0800 |
| commit | 178bd438af5c95deef5073416c60396f88e97ec9 (patch) | |
| tree | e6637a6b80a892746126e6270dc009466fc64885 /hw/arm/digic.c | |
| parent | 9c6b899f7a46893ab3b671e341a2234e9c0c060e (diff) | |
| download | focaccia-qemu-178bd438af5c95deef5073416c60396f88e97ec9.tar.gz focaccia-qemu-178bd438af5c95deef5073416c60396f88e97ec9.zip | |
block: Walk bs->children carefully in bdrv_drain_recurse
The recursive bdrv_drain_recurse may run a block job completion BH that drops nodes. The coming changes will make that more likely and use-after-free would happen without this patch Stash the bs pointer and use bdrv_ref/bdrv_unref in addition to QLIST_FOREACH_SAFE to prevent such a case from happening. Since bdrv_unref accesses global state that is not protected by the AioContext lock, we cannot use bdrv_ref/bdrv_unref unconditionally. Fortunately the protection is not needed in IOThread because only main loop can modify a graph with the AioContext lock held. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170418143044.12187-2-famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Tested-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
Diffstat (limited to 'hw/arm/digic.c')
0 files changed, 0 insertions, 0 deletions