mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-10-06 19:19:41 +00:00
abfcd2760b
dma_blk_cb() only takes the AioContext lock around ->io_func(). That means the rest of dma_blk_cb() is not protected. In particular, the DMAAIOCB field accesses happen outside the lock. There is a race when the main loop thread holds the AioContext lock and invokes scsi_device_purge_requests() -> bdrv_aio_cancel() -> dma_aio_cancel() while an IOThread executes dma_blk_cb(). The dbs->acb field determines how cancellation proceeds. If dma_aio_cancel() sees dbs->acb == NULL while dma_blk_cb() is still running, the request can be completed twice (-ECANCELED and the actual return value). The following assertion can occur with virtio-scsi when an IOThread is used: ../hw/scsi/scsi-disk.c:368: scsi_dma_complete: Assertion `r->req.aiocb != NULL' failed. Fix the race by holding the AioContext across dma_blk_cb(). Now dma_aio_cancel() under the AioContext lock will not see inconsistent/intermediate states. Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20230221212218.1378734-3-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> |
||
|---|---|---|
| .. | ||
| arch_init.c | ||
| balloon.c | ||
| bootdevice.c | ||
| cpu-throttle.c | ||
| cpu-timers.c | ||
| cpus.c | ||
| datadir.c | ||
| device_tree.c | ||
| dirtylimit.c | ||
| dma-helpers.c | ||
| globals.c | ||
| icount.c | ||
| ioport.c | ||
| main.c | ||
| memory.c | ||
| memory_mapping.c | ||
| meson.build | ||
| physmem.c | ||
| qdev-monitor.c | ||
| qemu-seccomp.c | ||
| qtest.c | ||
| rtc.c | ||
| runstate-action.c | ||
| runstate-hmp-cmds.c | ||
| runstate.c | ||
| timers-state.h | ||
| tpm-hmp-cmds.c | ||
| tpm.c | ||
| trace-events | ||
| trace.h | ||
| vl.c | ||