sim-card
/
qemu
Archived
10
0
Fork 0
Code Releases Activity

async: Allow nested qemu_bh_poll calls 

qemu may segfault when a BH handler first deletes a BH and then (possibly
indirectly) calls a nested qemu_bh_poll(). This is because the inner instance
frees the BH and deletes it from the list that the outer one processes.

This patch deletes BHs only in the outermost qemu_bh_poll instance.

Commit 7887f620 already tried to achieve the same, but it assumed that the BH
handler would only delete its own BH. With a nested qemu_bh_poll(), this isn't
guaranteed, so that commit wasn't enough. Hope this one fixes it for real.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Kevin Wolf 2011-09-01 16:16:10 +02:00
parent 0fa9131a44
commit 648fb0ea5e
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
async.c
View File

@ -55,6 +55,9 @@ int qemu_bh_poll(void)
{ {
QEMUBH *bh, **bhp, *next; QEMUBH *bh, **bhp, *next;
int ret; int ret;
static int nesting = 0;
nesting++;
ret = 0; ret = 0;
for (bh = first_bh; bh; bh = next) { for (bh = first_bh; bh; bh = next) {
@ -68,15 +71,20 @@ int qemu_bh_poll(void)
} }
} }
nesting--;
/* remove deleted bhs */ /* remove deleted bhs */
bhp = &first_bh; if (!nesting) {
while (*bhp) { bhp = &first_bh;
bh = *bhp; while (*bhp) {
if (bh->deleted) { bh = *bhp;
*bhp = bh->next; if (bh->deleted) {
g_free(bh); *bhp = bh->next;
} else g_free(bh);
bhp = &bh->next; } else {
bhp = &bh->next;
}
}
} }
return ret; return ret;