Re: [Qemu-devel] [PATCH RFT 0/3] iscsi: fix NULL dereferences / races between task completion and abort

[Paolo Bonzini]

Il 19/08/2012 09:55, Stefan Priebe ha scritto:
> Hi Paolo,
> 
> Am 18.08.2012 23:49, schrieb Paolo Bonzini:
>> Hi Stefan,
>>
>> this is my version of your patch.  I think the flow of the code is a
>> bit simpler (or at least matches other implementations of cancellation).
>> Can you test it on your test case?
> I'm really sorry but your patch doesn't work at all. I'm not even able
> to start the VM. KVM process hangs and never detaches itself.

No problem, my fault---I'm just back and I haven't really started again
all my stuff, so the patch was not tested.

This should fix it, though.

Paolo


diff --git a/block/iscsi.c b/block/iscsi.c
index 74ada64..0b96165 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -247,6 +247,7 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t
sector_num,
     acb->qiov     = qiov;

     acb->canceled   = 0;
+    acb->bh         = NULL;
     acb->status     = -EINPROGRESS;

     /* XXX we should pass the iovec to write16 to avoid the extra copy */
@@ -341,6 +342,7 @@ iscsi_aio_readv(BlockDriverState *bs, int64_t
sector_num,
     acb->qiov     = qiov;

     acb->canceled    = 0;
+    acb->bh          = NULL;
     acb->status      = -EINPROGRESS;
     acb->read_size   = qemu_read_size;
     acb->buf         = NULL;
@@ -442,6 +444,7 @@ iscsi_aio_flush(BlockDriverState *bs,

     acb->iscsilun = iscsilun;
     acb->canceled   = 0;
+    acb->bh         = NULL;
     acb->status     = -EINPROGRESS;

     acb->task = iscsi_synchronizecache10_task(iscsi, iscsilun->lun,
@@ -494,6 +497,7 @@ iscsi_aio_discard(BlockDriverState *bs,

     acb->iscsilun = iscsilun;
     acb->canceled   = 0;
+    acb->bh         = NULL;
     acb->status     = -EINPROGRESS;

     list[0].lba = sector_qemu2lun(sector_num, iscsilun);
@@ -568,6 +572,7 @@ static BlockDriverAIOCB
*iscsi_aio_ioctl(BlockDriverState *bs,

     acb->iscsilun = iscsilun;
     acb->canceled    = 0;
+    acb->bh          = NULL;
     acb->status      = -EINPROGRESS;
     acb->buf         = NULL;
     acb->ioh         = buf;