diff options
| author | Kevin Wolf | 2017-04-11 16:08:53 +0200 |
|---|---|---|
| committer | Peter Maydell | 2017-04-11 17:08:29 +0200 |
| commit | 5eceb01adfbe513c0309528293b0b86e32a6e27d (patch) | |
| tree | 680b15ec6975551011e63cb23cfe224830244c1f | |
| parent | Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2017-04-11' in... (diff) | |
| download | qemu-5eceb01adfbe513c0309528293b0b86e32a6e27d.tar.gz qemu-5eceb01adfbe513c0309528293b0b86e32a6e27d.tar.xz qemu-5eceb01adfbe513c0309528293b0b86e32a6e27d.zip | |
sheepdog: Fix crash in co_read_response()
This fixes a regression introduced in commit 9d456654.
aio_co_wake() can only be used to reenter a coroutine that was already
previously entered, otherwise co->ctx is uninitialised and we access
garbage. Using it immediately after qemu_coroutine_create() like in
co_read_response() is wrong and causes segfaults.
Replace the call with aio_co_enter(), which gets an explicit AioContext
parameter and works even for new coroutines.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1491919733-21065-1-git-send-email-kwolf@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | block/sheepdog.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/block/sheepdog.c b/block/sheepdog.c index 14d6327209..fb9203e9be 100644 --- a/block/sheepdog.c +++ b/block/sheepdog.c @@ -942,7 +942,7 @@ static void co_read_response(void *opaque) s->co_recv = qemu_coroutine_create(aio_read_response, opaque); } - aio_co_wake(s->co_recv); + aio_co_enter(s->aio_context, s->co_recv); } static void co_write_request(void *opaque) |