xemu/exec at e95205e1f9cd2c4262b7a7b1c992a94512c86d0e - xemu

mirror of https://github.com/mborgerson/xemu.git synced 2026-03-31 15:23:10 +00:00

Files

Fam Zheng e95205e1f9 dma-helpers: Fix race condition of continue_after_map_failure and dma_aio_cancel

If DMA's owning thread cancels the IO while the bounce buffer's owning thread
is notifying the "cpu client list", a use-after-free happens:

     continue_after_map_failure               dma_aio_cancel
     ------------------------------------------------------------------
     aio_bh_new
                                              qemu_bh_delete
     qemu_bh_schedule (use after free)

Also, the old code doesn't run the bh in the right AioContext.

Fix both problems by passing a QEMUBH to cpu_register_map_client.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1426496617-10702-6-git-send-email-famz@redhat.com>
[Remove unnecessary forward declaration. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2015-04-27 18:24:18 +02:00

user

…

address-spaces.h

…

cpu_ldst_template.h

cpu_ldst_template.h: Drop unused cpu_ldfq/stfq/ldfl/stfl accessors

2015-01-20 15:19:34 +00:00

cpu_ldst_useronly_template.h

cpu_ldst.h: Use inline functions for usermode cpu_ld/st accessors

2015-01-20 15:19:34 +00:00

cpu_ldst.h