)]}'
{
  "commit": "271c0f68b4eae72691721243a1c37f46a3232d61",
  "tree": "70ea4e56b2f6705022b0c5979bb1564829d9dda6",
  "parents": [
    "bd60436936ecebf2c683eef9ea561f2b949700f3"
  ],
  "author": {
    "name": "Fam Zheng",
    "email": "famz@redhat.com",
    "time": "Wed May 21 10:42:13 2014 +0800"
  },
  "committer": {
    "name": "Stefan Hajnoczi",
    "email": "stefanha@redhat.com",
    "time": "Wed May 28 14:28:46 2014 +0200"
  },
  "message": "aio: Fix use-after-free in cancellation path\n\nThe current flow of canceling a thread from THREAD_ACTIVE state is:\n\n  1) Caller wants to cancel a request, so it calls thread_pool_cancel.\n\n  2) thread_pool_cancel waits on the conditional variable\n     elem-\u003echeck_cancel.\n\n  3) The worker thread changes state to THREAD_DONE once the task is\n     done, and notifies elem-\u003echeck_cancel to allow thread_pool_cancel\n     to continue execution, and signals the notifier (pool-\u003enotifier) to\n     allow callback function to be called later. But because of the\n     global mutex, the notifier won\u0027t get processed until step 4) and 5)\n     are done.\n\n  4) thread_pool_cancel continues, leaving the notifier signaled, it\n     just returns to caller.\n\n  5) Caller thinks the request is already canceled successfully, so it\n     releases any related data, such as freeing elem-\u003ecommon.opaque.\n\n  6) In the next main loop iteration, the notifier handler,\n     event_notifier_ready, is called. It finds the canceled thread in\n     THREAD_DONE state, so calls elem-\u003ecommon.cb, with an (likely)\n     dangling opaque pointer. This is a use-after-free.\n\nFix it by calling event_notifier_ready before leaving\nthread_pool_cancel.\n\nTest case update: This change will let cancel complete earlier than\ntest-thread-pool.c expects, so update the code to check this case: if\nit\u0027s already done, done_cb sets .aiocb to NULL, skip calling\nbdrv_aio_cancel on them.\n\nReported-by: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nSuggested-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Fam Zheng \u003cfamz@redhat.com\u003e\nSigned-off-by: Stefan Hajnoczi \u003cstefanha@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c1f8e13a9f3fdbfb0d67a34534667b0e4df8a907",
      "old_mode": 33188,
      "old_path": "tests/test-thread-pool.c",
      "new_id": "aa156bcd32dc891e4c2d80426483acd4b23dc35e",
      "new_mode": 33188,
      "new_path": "tests/test-thread-pool.c"
    },
    {
      "type": "modify",
      "old_id": "fbdd3ffa3aeab3e88daecce0411b9724b564f6a9",
      "old_mode": 33188,
      "old_path": "thread-pool.c",
      "new_id": "dfb699dd94d200ec3d3e9dd32a193f7f08cf44da",
      "new_mode": 33188,
      "new_path": "thread-pool.c"
    }
  ]
}