From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=57935 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1OUchq-0004LG-6C for qemu-devel@nongnu.org; Fri, 02 Jul 2010 05:38:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1OUcho-0001lt-RE for qemu-devel@nongnu.org; Fri, 02 Jul 2010 05:38:46 -0400 Received: from verein.lst.de ([213.95.11.210]:37018) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1OUcho-0001kY-Fq for qemu-devel@nongnu.org; Fri, 02 Jul 2010 05:38:44 -0400 Date: Fri, 2 Jul 2010 11:38:36 +0200 From: Christoph Hellwig Subject: Re: [Qemu-devel] [PATCH 1/2] block: Fix too early free in multiwrite Message-ID: <20100702093836.GA21116@lst.de> References: <1277994718-14443-1-git-send-email-kwolf@redhat.com> <1277994718-14443-2-git-send-email-kwolf@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1277994718-14443-2-git-send-email-kwolf@redhat.com> List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Kevin Wolf Cc: qemu-devel@nongnu.org On Thu, Jul 01, 2010 at 04:31:57PM +0200, Kevin Wolf wrote: > bdrv_aio_writev may call the callback immediately (and it will commonly do so > in error cases). If num_requests doesn't have its final value yet, > multiwrite_cb will falsely detect that all requests are completed and frees > the mcb. However, the mcb is still used by other requests that are started only > afterwards. When all requests are completed, it is freed for the second time. > > Fix this by setting the right num_requests from the beginning. Looks good, Reviewed-by: Christoph Hellwig