Commit 5eceb01a authored by Kevin Wolf's avatar Kevin Wolf Committed by Peter Maydell
Browse files

sheepdog: Fix crash in co_read_response() 



This fixes a regression introduced in commit 9d456654.

aio_co_wake() can only be used to reenter a coroutine that was already
previously entered, otherwise co->ctx is uninitialised and we access
garbage. Using it immediately after qemu_coroutine_create() like in
co_read_response() is wrong and causes segfaults.

Replace the call with aio_co_enter(), which gets an explicit AioContext
parameter and works even for new coroutines.

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Tested-by: default avatarKashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Message-id: 1491919733-21065-1-git-send-email-kwolf@redhat.com
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent f5ac5cfe

block/sheepdog.c

+1 −1
Original line number Diff line number Diff line
@@ -942,7 +942,7 @@ static void co_read_response(void *opaque) 
        s->co_recv = qemu_coroutine_create(aio_read_response, opaque);

    }



    aio_co_wake(s->co_recv);

    aio_co_enter(s->aio_context, s->co_recv);

}



static void co_write_request(void *opaque)