| Message ID | 1565625509-404969-1-git-send-email-andrey.shinkevich@virtuozzo.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | char-socket: Fix race condition | expand |
On 12/08/19 17:58, Andrey Shinkevich wrote: > This fixes a race condition in which the tcp_chr_read() ioc handler > can close a connection that is being written to from another thread. > > v4: > The functions qemu_idle_add() and tcp_chr_be_event_closed() were removed > because the callback is invoked after the call to object_property_del_all() > so, the "chardev" object had been deleted and the segmentation fault occurs. > Let's please apply the Alberto's simplified series to avoid the race condition. > > v3: > See the email thread with the Message ID > <cover.1550842915.git.berto@igalia.com> > > Alberto Garcia (2): > main-loop: Fix GSource leak in qio_task_thread_worker() > char-socket: Lock tcp_chr_disconnect() > > chardev/char-socket.c | 16 +++++++++++++--- > io/task.c | 1 + > 2 files changed, 14 insertions(+), 3 deletions(-) > Queued, thanks. Paolo
On 21/08/2019 11:18, Paolo Bonzini wrote: > On 12/08/19 17:58, Andrey Shinkevich wrote: >> This fixes a race condition in which the tcp_chr_read() ioc handler >> can close a connection that is being written to from another thread. >> >> v4: >> The functions qemu_idle_add() and tcp_chr_be_event_closed() were removed >> because the callback is invoked after the call to object_property_del_all() >> so, the "chardev" object had been deleted and the segmentation fault occurs. >> Let's please apply the Alberto's simplified series to avoid the race condition. >> >> v3: >> See the email thread with the Message ID >> <cover.1550842915.git.berto@igalia.com> >> >> Alberto Garcia (2): >> main-loop: Fix GSource leak in qio_task_thread_worker() >> char-socket: Lock tcp_chr_disconnect() >> >> chardev/char-socket.c | 16 +++++++++++++--- >> io/task.c | 1 + >> 2 files changed, 14 insertions(+), 3 deletions(-) >> > > Queued, thanks. > > Paolo > Thanks you all too. Andrey
This fixes a race condition in which the tcp_chr_read() ioc handler can close a connection that is being written to from another thread. v4: The functions qemu_idle_add() and tcp_chr_be_event_closed() were removed because the callback is invoked after the call to object_property_del_all() so, the "chardev" object had been deleted and the segmentation fault occurs. Let's please apply the Alberto's simplified series to avoid the race condition. v3: See the email thread with the Message ID <cover.1550842915.git.berto@igalia.com> Alberto Garcia (2): main-loop: Fix GSource leak in qio_task_thread_worker() char-socket: Lock tcp_chr_disconnect() chardev/char-socket.c | 16 +++++++++++++--- io/task.c | 1 + 2 files changed, 14 insertions(+), 3 deletions(-)