Re: [Qemu-devel] [PATCH v2] aio: Fix use-after-free in cancellation path

2014-05-20 Thread Fam Zheng
On Tue, 05/20 16:01, Paolo Bonzini wrote: > Il 20/05/2014 15:16, Stefan Hajnoczi ha scritto: > >On Tue, May 20, 2014 at 10:00:47AM +0800, Fam Zheng wrote: > >>diff --git a/thread-pool.c b/thread-pool.c > >>index fbdd3ff..d4984ba 100644 > >>--- a/thread-pool.c > >>+++ b/thread-pool.c > >>@@ -223,6 +

Re: [Qemu-devel] [PATCH v2] aio: Fix use-after-free in cancellation path

2014-05-20 Thread Paolo Bonzini
Il 20/05/2014 15:16, Stefan Hajnoczi ha scritto: On Tue, May 20, 2014 at 10:00:47AM +0800, Fam Zheng wrote: diff --git a/thread-pool.c b/thread-pool.c index fbdd3ff..d4984ba 100644 --- a/thread-pool.c +++ b/thread-pool.c @@ -223,6 +223,7 @@ static void thread_pool_cancel(BlockDriverAIOCB *acb)

Re: [Qemu-devel] [PATCH v2] aio: Fix use-after-free in cancellation path

2014-05-20 Thread Stefan Hajnoczi
On Tue, May 20, 2014 at 10:00:47AM +0800, Fam Zheng wrote: > diff --git a/thread-pool.c b/thread-pool.c > index fbdd3ff..d4984ba 100644 > --- a/thread-pool.c > +++ b/thread-pool.c > @@ -223,6 +223,7 @@ static void thread_pool_cancel(BlockDriverAIOCB *acb) > } > pool->pending_cance

[Qemu-devel] [PATCH v2] aio: Fix use-after-free in cancellation path

2014-05-19 Thread Fam Zheng
The current flow of canceling a thread from THREAD_ACTIVE state is: 1) Caller wants to cancel a request, so it calls thread_pool_cancel. 2) thread_pool_cancel waits on the conditional variable elem->check_cancel. 3) The worker thread changes state to THREAD_DONE once the task is