From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:44417) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QWnMl-0000IP-4F for qemu-devel@nongnu.org; Wed, 15 Jun 2011 06:30:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QWnMj-0006BG-L9 for qemu-devel@nongnu.org; Wed, 15 Jun 2011 06:30:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41325) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QWnMj-0006Aq-6h for qemu-devel@nongnu.org; Wed, 15 Jun 2011 06:30:29 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p5FAUQae029937 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 15 Jun 2011 06:30:26 -0400 From: Kevin Wolf Date: Wed, 15 Jun 2011 12:33:17 +0200 Message-Id: <1308133997-4721-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] Allow nested qemu_bh_poll() after BH deletion List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com Without this, qemu segfaults when a BH handler first deletes its BH and then calls another function which involves a nested qemu_bh_poll() call. This can be reproduced by generating an I/O error (e.g. with blkdebug) on an IDE device and using rerror/werror=stop to stop the VM. When continuing the VM, qemu segfaults. Signed-off-by: Kevin Wolf --- async.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/async.c b/async.c index 57ac3a8..fd313df 100644 --- a/async.c +++ b/async.c @@ -137,11 +137,12 @@ QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque) int qemu_bh_poll(void) { - QEMUBH *bh, **bhp; + QEMUBH *bh, **bhp, *next; int ret; ret = 0; - for (bh = async_context->first_bh; bh; bh = bh->next) { + for (bh = async_context->first_bh; bh; bh = next) { + next = bh->next; if (!bh->deleted && bh->scheduled) { bh->scheduled = 0; if (!bh->idle) -- 1.7.5.2