* [PATCH] hw/dma: fix crash caused by race condition
[not found] <CGME20220408221711uscas1p2d64b2adae902cc51d328882980fbc50b@uscas1p2.samsung.com>
@ 2022-04-08 22:17 ` Tong Zhang
0 siblings, 0 replies; only message in thread
From: Tong Zhang @ 2022-04-08 22:17 UTC (permalink / raw)
To: Paolo Bonzini, Peter Xu, David Hildenbrand,
Philippe Mathieu-Daudé, qemu-devel@nongnu.org
Cc: ztong0001@gmail.com, Francisco Londono, Tong Zhang
assert(dbs->acb) is meant to check the return value of io_func per
documented in commit 6bee44ea34 ("dma: the passed io_func does not
return NULL"). However, there is a chance that after calling
aio_context_release(dbs->ctx); the dma_blk_cb function is called before
the assertion and dbs->acb is set to NULL again at line 121. Thus when
we run assert at line 181 it will fail.
softmmu/dma-helpers.c:181: dma_blk_cb: Assertion `dbs->acb' failed.
Reported-by: Francisco Londono <f.londono@samsung.com>
Signed-off-by: Tong Zhang <t.zhang2@samsung.com>
---
softmmu/dma-helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index 7820fec54c..cb81017928 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -177,8 +177,8 @@ static void dma_blk_cb(void *opaque, int ret)
aio_context_acquire(dbs->ctx);
dbs->acb = dbs->io_func(dbs->offset, &dbs->iov,
dma_blk_cb, dbs, dbs->io_func_opaque);
- aio_context_release(dbs->ctx);
assert(dbs->acb);
+ aio_context_release(dbs->ctx);
}
static void dma_aio_cancel(BlockAIOCB *acb)
--
2.25.1
^ permalink raw reply related [flat|nested] only message in thread