On 28/01/2018 05:14, CheneyLin wrote: >> This is dangerous, it risks introducing use-after-free bugs in the vCPU >> thread. Can you instead add a qemu_thread_join call where the vCPU goes >> away (e.g. unrealize, I'm not sure)? > > 1. If another thread calls qemu_thread_join, it will block until vcpu thread > exit.
Sure, but that's not a problem. If the code is written correctly, it will only block for a very short time. In particular, in this case we'll block anyway in cpu_remove_sync. The fix is just to change that function from qemu_cond_wait to qemu_thread_join. > 2. As vcpu exits, its resources should be freed ,which will not be used any > more(e.g. user space stack), how can we get use-after-free bugs? Use-after-free bugs happen in the vCPU thread if the vCPU resources are freed just before the vCPU thread exits. Paolo
