Re: [Qemu-devel] [PATCH] block/iscsi: fix potential segfault on early callback

[Peter Lieven]

On 10.06.2014 10:08, Paolo Bonzini wrote:
> Il 10/06/2014 09:52, Peter Lieven ha scritto:
> > it might happen in the future that a function directly invokes its callback.
> > In this case we end up in a segfault because the iTask is gone when the BH
> > is scheduled.
> >
> > Signed-off-by: Peter Lieven <address@hidden>
> > ---
> >  block/iscsi.c |    5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/block/iscsi.c b/block/iscsi.c
> > index 019b324..4bf4238 100644
> > --- a/block/iscsi.c
> > +++ b/block/iscsi.c
> > @@ -146,6 +146,7 @@ iscsi_schedule_bh(IscsiAIOCB *acb)
> >  static void iscsi_co_generic_bh_cb(void *opaque)
> >  {
> >      struct IscsiTask *iTask = opaque;
> > +    iTask->complete = 1;
> >      qemu_bh_delete(iTask->bh);
> >      qemu_coroutine_enter(iTask->co, NULL);
> >  }
> > @@ -153,6 +154,7 @@ static void iscsi_co_generic_bh_cb(void *opaque)
> >  static void iscsi_retry_timer_expired(void *opaque)
> >  {
> >      struct IscsiTask *iTask = opaque;
> > +    iTask->complete = 1;
> >      if (iTask->co) {
> >          qemu_coroutine_enter(iTask->co, NULL);
> >      }
> > @@ -171,7 +173,6 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
> >      struct IscsiTask *iTask = opaque;
> >      struct scsi_task *task = command_data;
> >
> > -    iTask->complete = 1;
> >      iTask->status = status;
> >      iTask->do_retry = 0;
> >      iTask->task = task;
> > @@ -209,6 +210,8 @@ out:
> >          iTask->bh = aio_bh_new(iTask->iscsilun->aio_context,
> >                                 iscsi_co_generic_bh_cb, iTask);
> >          qemu_bh_schedule(iTask->bh);
> > +    } else {
> > +        iTask->complete = 1;
> >      }
> >  }
>
> Applied, thanks.  I'll leave the nfs patch to Kevin and/or Stefan.

Thank you,

Stefan/Kevin I messed up the commit message. Can you please fix when picking up:

---8<---

it will happen in the future that a function directly invokes its callback.
In this case we end up in a segfault because the NFSRPC is gone when we the
BH is scheduled.

--->8---

Thanks,
Peter