OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

Pull request

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAl1euk0ACgkQnKSrs4Gr
 c8i6pgf/XNxaPvbfEZCjRevhYjgrg33/UJYPxyK3Qx6V9+Kx1rhL7AwGvVWTh5Z7
 2dghE8qUmcdOuVdUyZsGGOUOh2zviGv2kaSD4LyTP3Av5RcN0q21FT7HgGmaTWdC
 Ljo9d3km+MnBNHkFQuevQke9+31N62Ewyh/7V0yyVTrPk7zMY0/d7j93EC86NRzv
 5GiZQ3riRUE6TshlvpkM59WVy8U5ItPCTrClRNYzlMvCoP7EzjgSPFEQIyNpcXOe
 1amY2dzdUuS95Wkxbcp1Td1ptzJr1XRCHKtHogoKDramwepcQR/jsdMyTU58elJO
 s/VrA8yS+TW00XVxXjAnDSRo1H5nHQ==
 =0W2f
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Pull request

# gpg: Signature made Thu 22 Aug 2019 16:52:45 BST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  vhost-user-scsi: prevent using uninitialized vqs
  util/async: hold AioContext ref to prevent use-after-free

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2019-08-23 16:11:35 +01:00
commit 5428e12d52
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/scsi/vhost-user-scsi.c
View File

@ -93,7 +93,7 @@ static void vhost_user_scsi_realize(DeviceState *dev, Error **errp)
} }
vsc->dev.nvqs = 2 + vs->conf.num_queues; vsc->dev.nvqs = 2 + vs->conf.num_queues;
vsc->dev.vqs = g_new(struct vhost_virtqueue, vsc->dev.nvqs); vsc->dev.vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs);
vsc->dev.vq_index = 0; vsc->dev.vq_index = 0;
vsc->dev.backend_features = 0; vsc->dev.backend_features = 0;
vqs = vsc->dev.vqs; vqs = vsc->dev.vqs;

8
util/async.c
View File

@ -459,9 +459,17 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co)
abort(); abort();
} }
/* The coroutine might run and release the last ctx reference before we
* invoke qemu_bh_schedule(). Take a reference to keep ctx alive until
* we're done.
*/
aio_context_ref(ctx);
QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines, QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
co, co_scheduled_next); co, co_scheduled_next);
qemu_bh_schedule(ctx->co_schedule_bh); qemu_bh_schedule(ctx->co_schedule_bh);
aio_context_unref(ctx);
} }
void aio_co_wake(struct Coroutine *co) void aio_co_wake(struct Coroutine *co)