The .drained_begin/end callbacks can (directly or indirectly via
aio_poll()) cause block nodes to be removed or the current BdrvChild to
point to a different child node.
Use QLIST_FOREACH_SAFE() to make sure we don't access invalid
BlockDriverStates or accidentally continue iterating the parents of the
new child node instead of the node we actually came from.
Signed-off-by: Kevin Wolf <kw...@redhat.com>
Tested-by: Jeff Cody <jc...@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
Reviewed-by: Jeff Cody <jc...@redhat.com>
Reviewed-by: Alberto Garcia <be...@igalia.com>
Reviewed-by: Fam Zheng <f...@redhat.com>
Signed-off-by: Kevin Wolf <kw...@redhat.com>
---
block/io.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/block/io.c b/block/io.c
index 4fdf93a014..6773926fc1 100644
--- a/block/io.c
+++ b/block/io.c
@@ -42,9 +42,9 @@ static int coroutine_fn
bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
void bdrv_parent_drained_begin(BlockDriverState *bs)
{
- BdrvChild *c;
+ BdrvChild *c, *next;
- QLIST_FOREACH(c, &bs->parents, next_parent) {
+ QLIST_FOREACH_SAFE(c, &bs->parents, next_parent, next) {
if (c->role->drained_begin) {
c->role->drained_begin(c);
}
@@ -53,9 +53,9 @@ void bdrv_parent_drained_begin(BlockDriverState *bs)
void bdrv_parent_drained_end(BlockDriverState *bs)
{
- BdrvChild *c;
+ BdrvChild *c, *next;
- QLIST_FOREACH(c, &bs->parents, next_parent) {
+ QLIST_FOREACH_SAFE(c, &bs->parents, next_parent, next) {
if (c->role->drained_end) {
c->role->drained_end(c);
}
--
2.13.6
