Fam Zheng 178bd438af block: Walk bs->children carefully in bdrv_drain_recurse ... The recursive bdrv_drain_recurse may run a block job completion BH that drops nodes. The coming changes will make that more likely and use-after-free would happen without this patch Stash the bs pointer and use bdrv_ref/bdrv_unref in addition to QLIST_FOREACH_SAFE to prevent such a case from happening. Since bdrv_unref accesses global state that is not protected by the AioContext lock, we cannot use bdrv_ref/bdrv_unref unconditionally. Fortunately the protection is not needed in IOThread because only main loop can modify a graph with the AioContext lock held. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170418143044.12187-2-famz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Tested-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>		2017-04-18 22:56:28 +08:00
..
accounting.c	block: Clean up includes	2016-01-20 13:36:23 +01:00
backup.c	backup: React to bdrv_is_allocated() errors	2017-03-13 12:49:33 +01:00
blkdebug.c	block: Request child permissions in filter drivers	2017-02-28 20:40:36 +01:00
blkreplay.c	block: Request child permissions in filter drivers	2017-02-28 20:40:36 +01:00
blkverify.c	block: Request child permissions in filter drivers	2017-02-28 20:40:36 +01:00
block-backend.c	throttle: Remove block from group on hot-unplug	2017-04-11 15:33:00 +02:00
bochs.c	block: Request child permissions in format drivers	2017-02-28 20:40:36 +01:00
cloop.c	block: Request child permissions in format drivers	2017-02-28 20:40:36 +01:00
commit.c	commit: Set commit_top_bs->total_sectors	2017-04-07 14:44:05 +02:00
crypto.c	block: Request child permissions in format drivers	2017-02-28 20:40:36 +01:00
curl.c	block/curl: Check protocol prefix	2017-03-31 15:53:22 -04:00
dirty-bitmap.c	block: More operations for meta dirty bitmap	2016-10-24 17:56:07 +02:00
dmg-bz2.c	dmg: Move libbz2 code to dmg-bz2.so	2016-10-07 14:14:06 +02:00
dmg.c	block: Request child permissions in format drivers	2017-02-28 20:40:36 +01:00
dmg.h	dmg: Move libbz2 code to dmg-bz2.so	2016-10-07 14:14:06 +02:00
file-posix.c	block: Document -drive problematic code and bugs	2017-04-03 17:11:39 +02:00
file-win32.c	block: Rename raw-{posix,win32} to file-*.c	2017-01-09 13:30:53 +01:00
gluster.c	qapi-schema: SocketAddressFlat variants 'vsock' and 'fd'	2017-04-03 17:11:39 +02:00
io.c	block: Walk bs->children carefully in bdrv_drain_recurse	2017-04-18 22:56:28 +08:00
iscsi-opts.c	block/iscsi: statically link qemu_iscsi_opts	2017-01-27 18:07:58 +01:00
iscsi.c	iscsi: Fix iscsi_create	2017-04-11 15:33:00 +02:00
linux-aio.c	block: explicitly acquire aiocontext in aio callbacks that need it	2017-02-21 11:39:39 +00:00
Makefile.objs	block: Drop unmaintained 'archipelago' driver	2017-03-13 12:49:33 +01:00
mirror.c	mirror: Fix aio context of mirror_top_bs	2017-04-07 14:44:06 +02:00
nbd-client.c	nbd-client: fix handling of hungup connections	2017-03-27 16:50:36 +02:00
nbd-client.h	nbd: drop unused NBDClientSession.is_unix field	2017-03-27 14:41:01 +02:00
nbd.c	* MemoryRegionCache revert	2017-04-04 11:40:55 +01:00
nfs.c	block: Document -drive problematic code and bugs	2017-04-03 17:11:39 +02:00
null.c	block: explicitly acquire aiocontext in aio callbacks that need it	2017-02-21 11:39:39 +00:00
parallels.c	block/parallels: Avoid overflows	2017-04-03 17:11:40 +02:00
qapi.c	block: Don't bother asserting type of output visitor's output	2017-02-22 19:52:20 +01:00
qcow2-cache.c	qcow2: Remove stale comment	2016-11-25 13:51:30 +01:00
qcow2-cluster.c	qcow2: Discard unaligned tail when wiping image	2017-04-03 17:11:40 +02:00
qcow2-refcount.c	block: Pass BdrvChild to bdrv_truncate()	2017-02-24 16:09:23 +01:00
qcow2-snapshot.c	block: Convert bdrv_pwrite(v/_sync) to BdrvChild	2016-07-05 16:46:27 +02:00
qcow2.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
qcow2.h	qcow2: Optimize the refcount-block overlap check	2017-02-12 00:47:43 +01:00
qcow.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
qed-check.c	qed: Use DIV_ROUND_UP	2016-06-07 18:19:24 +03:00
qed-cluster.c	block: explicitly acquire aiocontext in aio callbacks that need it	2017-02-21 11:39:39 +00:00
qed-gencb.c	block: Clean up includes	2016-01-20 13:36:23 +01:00
qed-l2-cache.c	block: Clean up includes	2016-01-20 13:36:23 +01:00
qed-table.c	block: explicitly acquire aiocontext in aio callbacks that need it	2017-02-21 11:39:39 +00:00
qed.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
qed.h	block: explicitly acquire aiocontext in timers that need it	2017-02-21 11:14:08 +00:00
quorum.c	block: Request child permissions in filter drivers	2017-02-28 20:40:36 +01:00
raw-format.c	block: Request child permissions in filter drivers	2017-02-28 20:40:36 +01:00
rbd.c	block: Document -drive problematic code and bugs	2017-04-03 17:11:39 +02:00
replication.c	replication: clarify permissions	2017-03-17 12:54:06 +01:00
sheepdog.c	sheepdog: Fix crash in co_read_response()	2017-04-11 16:08:29 +01:00
snapshot.c	block: pass the right options for BlockDriver.bdrv_open()	2017-04-11 15:33:00 +02:00
ssh.c	block: Document -drive problematic code and bugs	2017-04-03 17:11:39 +02:00
stream.c	block: Add Error parameter to bdrv_set_backing_hd()	2017-02-28 20:47:51 +01:00
throttle-groups.c	coroutine-lock: add mutex argument to CoQueue APIs	2017-02-21 11:39:40 +00:00
trace-events	trace: clean up trace-events files	2017-01-31 17:12:15 +00:00
vdi.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
vhdx-endian.c	vhdx: Use QEMU UUID API	2016-09-23 11:42:52 +08:00
vhdx-log.c	block: Pass BdrvChild to bdrv_truncate()	2017-02-24 16:09:23 +01:00
vhdx.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
vhdx.h	block: vhdx - update PAYLOAD_BLOCK_UNMAPPED value to match 1.00 spec	2014-12-12 15:42:22 +00:00
vmdk.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
vpc.c	block: Add BDRV_O_RESIZE for blk_new_open()	2017-02-28 20:40:36 +01:00
vvfat.c	vvfat: React to bdrv_is_allocated() errors	2017-03-13 12:49:33 +01:00
win32-aio.c	block: explicitly acquire aiocontext in aio callbacks that need it	2017-02-21 11:39:39 +00:00
write-threshold.c	block: use bdrv_add_before_write_notifier	2016-10-07 13:34:07 +02:00