From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=57941 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Phftw-0003Px-1r for qemu-devel@nongnu.org; Tue, 25 Jan 2011 05:13:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Phftu-0005p7-38 for qemu-devel@nongnu.org; Tue, 25 Jan 2011 05:13:27 -0500 Received: from mail-ew0-f45.google.com ([209.85.215.45]:62229) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Phftt-0005ok-E1 for qemu-devel@nongnu.org; Tue, 25 Jan 2011 05:13:26 -0500 Received: by ewy10 with SMTP id 10so2599912ewy.4 for ; Tue, 25 Jan 2011 02:13:24 -0800 (PST) MIME-Version: 1.0 In-Reply-To: References: <1295902845-29807-3-git-send-email-aliguori@us.ibm.com> <1295944407-19680-2-git-send-email-corentin.chary@gmail.com> Date: Tue, 25 Jan 2011 10:13:24 +0000 Message-ID: Subject: Re: [Qemu-devel] [PATCH 1/2] vl.c: set NULL upon deleting handlers in qemu_set_fd_handler2() From: Corentin Chary Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Anthony Liguori , qemu-devel@nongnu.org, Yoshiaki Tamura On Tue, Jan 25, 2011 at 10:03 AM, Stefan Hajnoczi wrot= e: > On Tue, Jan 25, 2011 at 8:33 AM, Corentin Chary > wrote: >> From: Yoshiaki Tamura >> >> Currently qemu_set_fd_handler2() is only setting ioh->deleted upon >> deleting. =C2=A0This may cause a crash when a read handler calls >> qemu_set_fd_handler2() to delete handlers, but a write handler is >> still invoked from main_loop_wait(). =C2=A0Because main_loop_wait() chec= ks >> handlers before calling, setting NULL upon deleting will protect >> handlers being called if already deleted. >> >> One example is the new threaded vnc server. =C2=A0When an error occurs i= n >> the context of a read handler, it'll releases resources and deletes >> handlers. =C2=A0However, because the write handler still exists, it'll b= e >> called, and then crashes because of lack of resources. =C2=A0This patch >> fixes it. > > Does this case still happen with qemu.git/master? =C2=A0In November I sen= t > a patch to check for deleted handlers: > > commit 0290b57bdfec83ca78b6d119ea9847bb17943328 > Author: Stefan Hajnoczi > Date: =C2=A0 Wed Nov 3 14:29:44 2010 +0000 > > =C2=A0 =C2=A0Delete IOHandlers after potentially running them > > =C2=A0 =C2=A0Since commit 4bed9837309e58d208183f81d8344996744292cf an .fd= _read() > =C2=A0 =C2=A0handler that deletes its IOHandler is exposed to .fd_write()= being > =C2=A0 =C2=A0called on the deleted IOHandler. > > =C2=A0 =C2=A0This patch fixes deletion so that .fd_read() and .fd_write()= are never > =C2=A0 =C2=A0called on an IOHandler that is marked for deletion. > > =C2=A0 =C2=A0Signed-off-by: Stefan Hajnoczi > =C2=A0 =C2=A0Signed-off-by: Anthony Liguori > > So I don't think Yoshi's patch is necessary anymore? Ho I didn't see that one. It's probably not necessary, but it stills make sense to apply this patch since there is absolutly no reasons to keep the old value in fd_read and fd_write when the user explicitly asked to set them to NULL. --=20 Corentin Chary http://xf.iksaif.net