Commit 5428e12d authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging 



Pull request

# gpg: Signature made Thu 22 Aug 2019 16:52:45 BST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  vhost-user-scsi: prevent using uninitialized vqs
  util/async: hold AioContext ref to prevent use-after-free

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 586f3dce 5d4c1ed3

hw/scsi/vhost-user-scsi.c

+1 −1
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ static void vhost_user_scsi_realize(DeviceState *dev, Error **errp) 
    }



    vsc->dev.nvqs = 2 + vs->conf.num_queues;

    vsc->dev.vqs = g_new(struct vhost_virtqueue, vsc->dev.nvqs);

    vsc->dev.vqs = g_new0(struct vhost_virtqueue, vsc->dev.nvqs);

    vsc->dev.vq_index = 0;

    vsc->dev.backend_features = 0;

    vqs = vsc->dev.vqs;

util/async.c

+8 −0
Original line number Diff line number Diff line
@@ -459,9 +459,17 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co) 
        abort();

    }



    /* The coroutine might run and release the last ctx reference before we

     * invoke qemu_bh_schedule().  Take a reference to keep ctx alive until

     * we're done.

     */

    aio_context_ref(ctx);



    QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,

                              co, co_scheduled_next);

    qemu_bh_schedule(ctx->co_schedule_bh);



    aio_context_unref(ctx);

}



void aio_co_wake(struct Coroutine *co)