gwj / at91sam9263 · Commits

Commit f094a78220187996e33ba5adce29789326cf6c3c

Authored by aliguori
1 parent f48c144e

Fix race in POSIX AIO emulation (Jan Kiszka) 

When we cancel an AIO request that is already being processed by
aio_thread, qemu_paio_cancel should return QEMU_PAIO_NOTCANCELED as long
as aio_thread isn't done with this request. But as the latter currently
updates aiocb->ret after every block of the request, we may report
QEMU_PAIO_ALLDONE too early.

Futhermore, in case some zero-length request should have been queued,
aiocb->ret is never set to != -EINPROGRESS and callers like
raw_aio_cancel could get stuck in an endless loop.

Fix those issues by updating aiocb->ret _after_ the request has been
fully processed. This also simplifies the locking.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6278 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 2 additions and 7 deletions
posix-aio-compat.c
  View file @f094a78
... ... @@ -81,21 +81,16 @@ static void *aio_thread(void *unused)
81 81 if (len == -1 && errno == EINTR)
82 82 continue;
83 83 else if (len == -1) {
84   - pthread_mutex_lock(&lock);
85   - aiocb->ret = -errno;
86   - pthread_mutex_unlock(&lock);
  84 + offset = -errno;
87 85 break;
88 86 } else if (len == 0)
89 87 break;
90 88  
91 89 offset += len;
92   -
93   - pthread_mutex_lock(&lock);
94   - aiocb->ret = offset;
95   - pthread_mutex_unlock(&lock);
96 90 }
97 91  
98 92 pthread_mutex_lock(&lock);
  93 + aiocb->ret = offset;
99 94 idle_threads++;
100 95 pthread_mutex_unlock(&lock);
101 96  
... ...