[Qemu-devel] [PATCH] blkdebug: Use QLIST_FOREACH_SAFE to resume IO

[Qemu-devel] [PATCH] blkdebug: Use QLIST_FOREACH_SAFE to resume IO

[Fam Zheng]

Qemu-iotest 030 was broken.

When the coroutine runs and finishes, it will remove itself from the req
list, so let's use safe version of foreach to avoid use after free.

Signed-off-by: Fam Zheng <famz@redhat.com>
---
 block/blkdebug.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/blkdebug.c b/block/blkdebug.c
index 37cf028..957be2c 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -594,9 +594,9 @@ static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
 static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
 {
     BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
+    BlkdebugSuspendedReq *r, *next;
 
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
+    QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, next) {
         if (!strcmp(r->tag, tag)) {
             qemu_coroutine_enter(r->co, NULL);
             return 0;
@@ -609,7 +609,7 @@ static int blkdebug_debug_remove_breakpoint(BlockDriverState *bs,
                                             const char *tag)
 {
     BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
+    BlkdebugSuspendedReq *r, *r_next;
     BlkdebugRule *rule, *next;
     int i, ret = -ENOENT;
 
@@ -622,7 +622,7 @@ static int blkdebug_debug_remove_breakpoint(BlockDriverState *bs,
             }
         }
     }
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
+    QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, r_next) {
         if (!strcmp(r->tag, tag)) {
             qemu_coroutine_enter(r->co, NULL);
             ret = 0;
-- 
1.8.5.1

Re: [Qemu-devel] [PATCH] blkdebug: Use QLIST_FOREACH_SAFE to resume IO

[Kevin Wolf]

Am 13.12.2013 um 08:25 hat Fam Zheng geschrieben:
> Qemu-iotest 030 was broken.
> 
> When the coroutine runs and finishes, it will remove itself from the req
> list, so let's use safe version of foreach to avoid use after free.
> 
> Signed-off-by: Fam Zheng <famz@redhat.com>

Thanks, applied to the block branch.

> diff --git a/block/blkdebug.c b/block/blkdebug.c
> index 37cf028..957be2c 100644
> --- a/block/blkdebug.c
> +++ b/block/blkdebug.c
> @@ -594,9 +594,9 @@ static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
>  static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
>  {
>      BDRVBlkdebugState *s = bs->opaque;
> -    BlkdebugSuspendedReq *r;
> +    BlkdebugSuspendedReq *r, *next;
>  
> -    QLIST_FOREACH(r, &s->suspended_reqs, next) {
> +    QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, next) {
>          if (!strcmp(r->tag, tag)) {
>              qemu_coroutine_enter(r->co, NULL);
>              return 0;

This hunk wasn't strictly necessary because of the return 0, but it
doesn't hurt either.

Kevin