From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=46092 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PDf16-0001uq-6h
	for qemu-devel@nongnu.org; Wed, 03 Nov 2010 11:12:49 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <quintela@redhat.com>) id 1PDf14-0004Le-L9
	for qemu-devel@nongnu.org; Wed, 03 Nov 2010 11:12:48 -0400
Received: from mx1.redhat.com ([209.132.183.28]:23100)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <quintela@redhat.com>) id 1PDf14-0004LT-Ea
	for qemu-devel@nongnu.org; Wed, 03 Nov 2010 11:12:46 -0400
From: Juan Quintela <quintela@redhat.com>
In-Reply-To: <4CD17861.2060806@codemonkey.ws> (Anthony Liguori's message of
	"Wed, 03 Nov 2010 09:57:37 -0500")
References: <1288794584-6099-1-git-send-email-stefanha@linux.vnet.ibm.com>
	<4CD17861.2060806@codemonkey.ws>
Date: Wed, 03 Nov 2010 16:12:39 +0100
Message-ID: <m3k4kuh254.fsf@trasno.mitica>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: [Qemu-devel] Re: [PATCH] Delete IOHandlers after potentially
	running them
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Anthony Liguori <anthony@codemonkey.ws>
Cc: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>, qemu-devel@nongnu.org

Anthony Liguori <anthony@codemonkey.ws> wrote:
> On 11/03/2010 09:29 AM, Stefan Hajnoczi wrote:
>> Since commit 4bed9837309e58d208183f81d8344996744292cf an .fd_read()
>> handler that deletes its IOHandler is exposed to .fd_write() being
>> called on the deleted IOHandler.
>>
>> This patch fixes deletion so that .fd_read() and .fd_write() are never
>> called on an IOHandler that is marked for deletion.
>>
>> Signed-off-by: Stefan Hajnoczi<stefanha@linux.vnet.ibm.com>
>> ---
>>   vl.c |   15 ++++++++-------
>>   1 files changed, 8 insertions(+), 7 deletions(-)
>>
>> diff --git a/vl.c b/vl.c
>> index 7038952..6f56123 100644
>> --- a/vl.c
>> +++ b/vl.c
>> @@ -1252,17 +1252,18 @@ void main_loop_wait(int nonblocking)
>>           IOHandlerRecord *pioh;
>>
>>           QLIST_FOREACH_SAFE(ioh,&io_handlers, next, pioh) {
>> -            if (ioh->deleted) {
>> -                QLIST_REMOVE(ioh, next);
>> -                qemu_free(ioh);
>> -                continue;
>> -            }
>> -            if (ioh->fd_read&&  FD_ISSET(ioh->fd,&rfds)) {
>> +            if (!ioh->deleted&&  ioh->fd_read&&  FD_ISSET(ioh->fd,&rfds)) {
>>                   ioh->fd_read(ioh->opaque);
>>               }
>> -            if (ioh->fd_write&&  FD_ISSET(ioh->fd,&wfds)) {
>> +            if (!ioh->deleted&&  ioh->fd_write&&  FD_ISSET(ioh->fd,&wfds)) {
>>                   ioh->fd_write(ioh->opaque);
>>               }
>> +
>> +            /* Do this last in case read/write handlers marked it for deletion */
>> +            if (ioh->deleted) {
>> +                QLIST_REMOVE(ioh, next);
>> +                qemu_free(ioh);
>> +            }
>>           }
>>    
>
> This isn't enough.  If you end up with a handler deleting the next
> pointer and the current pointer, you'll end up running off the end of
> the list.

What is the point of that?

That a handler can remove itself is ok.
But that a handler can remove also the next in a list that is used for
other things looks pretty insane to me.

> The original commit should be reverted.

If that behaviour is expected, then I agree that we should revert it.
But I would consider that behaviour wrong.

Later, Juan.

> Regards,
>
> Anthony Liguori
>
>>       }
>>
>>