Re: [Qemu-devel] [PATCH v2] aio: Fix use-after-free in cancellation path

[Fam Zheng <famz@redhat.com>]

On Tue, 05/20 16:01, Paolo Bonzini wrote:
> Il 20/05/2014 15:16, Stefan Hajnoczi ha scritto:
> >On Tue, May 20, 2014 at 10:00:47AM +0800, Fam Zheng wrote:
> >>diff --git a/thread-pool.c b/thread-pool.c
> >>index fbdd3ff..d4984ba 100644
> >>--- a/thread-pool.c
> >>+++ b/thread-pool.c
> >>@@ -223,6 +223,7 @@ static void thread_pool_cancel(BlockDriverAIOCB *acb)
> >>         }
> >>         pool->pending_cancellations--;
> >>     }
> >>+    event_notifier_ready(&pool->notifier);
> >>     qemu_mutex_unlock(&pool->lock);
> >> }
> >
> >event_notifier_ready() doesn't need pool->lock.  Can you call it outside
> >the lock or am I missing something?
> 
> Yes, in fact I'm a bit wary of calling it inside the lock.

OK, thanks.

Fam