diff options
| author | Peter Maydell | 2019-08-23 17:11:35 +0200 |
|---|---|---|
| committer | Peter Maydell | 2019-08-23 17:11:35 +0200 |
| commit | 5428e12d528fcbe31e8a9b236d1359ad52066382 (patch) | |
| tree | c9cc9dac8e14f61fb4dc39ce44a9bf34eb49615e | |
| parent | Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20190822' into staging (diff) | |
| parent | vhost-user-scsi: prevent using uninitialized vqs (diff) | |
| download | qemu-5428e12d528fcbe31e8a9b236d1359ad52066382.tar.gz qemu-5428e12d528fcbe31e8a9b236d1359ad52066382.tar.xz qemu-5428e12d528fcbe31e8a9b236d1359ad52066382.zip | |
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Pull request
# gpg: Signature made Thu 22 Aug 2019 16:52:45 BST
# gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8
* remotes/stefanha/tags/block-pull-request:
vhost-user-scsi: prevent using uninitialized vqs
util/async: hold AioContext ref to prevent use-after-free
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/scsi/vhost-user-scsi.c | 2 | ||||
| -rw-r--r-- | util/async.c | 8 |
2 files changed, 9 insertions, 1 deletions
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c index 31c9d34637..6a6c15dd32 100644 --- a/hw/scsi/vhost-user-scsi.c +++ b/hw/scsi/vhost-user-scsi.c @@ -93,7 +93,7 @@ static void vhost_user_scsi_realize(DeviceState *dev, Error **errp) } vsc->dev.nvqs = 2 + vs->conf.num_queues; - vsc->dev.vqs = g_new(struct vhost_virtqueue, vsc->dev.nvqs); + vsc->dev.vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vq_index = 0; vsc->dev.backend_features = 0; vqs = vsc->dev.vqs; diff --git a/util/async.c b/util/async.c index 8d2105729c..4e4c7af51e 100644 --- a/util/async.c +++ b/util/async.c @@ -459,9 +459,17 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co) abort(); } + /* The coroutine might run and release the last ctx reference before we + * invoke qemu_bh_schedule(). Take a reference to keep ctx alive until + * we're done. + */ + aio_context_ref(ctx); + QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines, co, co_scheduled_next); qemu_bh_schedule(ctx->co_schedule_bh); + + aio_context_unref(ctx); } void aio_co_wake(struct Coroutine *co) |