diff mbox

block/nfs: fix potential segfault on early callback

Message ID 1402386167-8091-1-git-send-email-pl@kamp.de
State New
Headers show

Commit Message

Peter Lieven June 10, 2014, 7:42 a.m. UTC 
it will happen in the future that the callback of a libnfs call
directly invokes the callback. In this case we end up in a segfault
because the NFSRPC is gone when we the BH is scheduled.

Signed-off-by: Peter Lieven <pl@kamp.de>
---
 block/nfs.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Stefan Hajnoczi June 11, 2014, 11:46 a.m. UTC | #1 
On Tue, Jun 10, 2014 at 09:42:47AM +0200, Peter Lieven wrote:
> it will happen in the future that the callback of a libnfs call
> directly invokes the callback. In this case we end up in a segfault
> because the NFSRPC is gone when we the BH is scheduled.
> 
> Signed-off-by: Peter Lieven <pl@kamp.de>
> ---
>  block/nfs.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan
diff mbox

Patch

diff --git a/block/nfs.c b/block/nfs.c
index bd9177f..e282f8d 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -95,6 +95,7 @@  static void nfs_co_init_task(NFSClient *client, NFSRPC *task)
 static void nfs_co_generic_bh_cb(void *opaque)
 {
     NFSRPC *task = opaque;
+    task->complete = 1;
     qemu_bh_delete(task->bh);
     qemu_coroutine_enter(task->co, NULL);
 }
@@ -104,7 +105,6 @@  nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
                   void *private_data)
 {
     NFSRPC *task = private_data;
-    task->complete = 1;
     task->ret = ret;
     if (task->ret > 0 && task->iov) {
         if (task->ret <= task->iov->size) {
@@ -123,6 +123,8 @@  nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
         task->bh = aio_bh_new(task->client->aio_context,
                               nfs_co_generic_bh_cb, task);
         qemu_bh_schedule(task->bh);
+    } else {
+        task->complete = 1;
     }
 }