Re: [Qemu-devel] [PATCH v3] aio: Fix use-after-free in cancellation path

2014-05-21 Thread Stefan Hajnoczi
On Wed, May 21, 2014 at 10:42:13AM +0800, Fam Zheng wrote: > The current flow of canceling a thread from THREAD_ACTIVE state is: > > 1) Caller wants to cancel a request, so it calls thread_pool_cancel. > > 2) thread_pool_cancel waits on the conditional variable > elem->check_cancel. > >

[Qemu-devel] [PATCH v3] aio: Fix use-after-free in cancellation path

2014-05-20 Thread Fam Zheng
The current flow of canceling a thread from THREAD_ACTIVE state is: 1) Caller wants to cancel a request, so it calls thread_pool_cancel. 2) thread_pool_cancel waits on the conditional variable elem->check_cancel. 3) The worker thread changes state to THREAD_DONE once the task is