diff options
| author | Fam Zheng | 2017-04-18 16:30:43 +0200 |
|---|---|---|
| committer | Fam Zheng | 2017-04-18 16:56:28 +0200 |
| commit | 178bd438af5c95deef5073416c60396f88e97ec9 (patch) | |
| tree | e6637a6b80a892746126e6270dc009466fc64885 /hw/timer/i8254_common.c | |
| parent | 9pfs: local: set the path of the export root to "." (diff) | |
| download | qemu-178bd438af5c95deef5073416c60396f88e97ec9.tar.gz qemu-178bd438af5c95deef5073416c60396f88e97ec9.tar.xz qemu-178bd438af5c95deef5073416c60396f88e97ec9.zip | |
block: Walk bs->children carefully in bdrv_drain_recurse
The recursive bdrv_drain_recurse may run a block job completion BH that
drops nodes. The coming changes will make that more likely and use-after-free
would happen without this patch
Stash the bs pointer and use bdrv_ref/bdrv_unref in addition to
QLIST_FOREACH_SAFE to prevent such a case from happening.
Since bdrv_unref accesses global state that is not protected by the AioContext
lock, we cannot use bdrv_ref/bdrv_unref unconditionally. Fortunately the
protection is not needed in IOThread because only main loop can modify a graph
with the AioContext lock held.
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170418143044.12187-2-famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Tested-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Diffstat (limited to 'hw/timer/i8254_common.c')
0 files changed, 0 insertions, 0 deletions