From: Fam Zheng <famz@redhat.com>
Date: Fri, 22 Aug 2014 04:45:50 +0000 (+0800)
Subject: blkdebug: Delete BH in bdrv_aio_cancel
X-Git-Tag: v2.1.1~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fab7560c352475ebf5ab50be9e327e0eabff1a3b;p=thirdparty%2Fqemu.git

blkdebug: Delete BH in bdrv_aio_cancel

Otherwise error_callback_bh will access the already released acb.

Cc: qemu-stable@nongnu.org
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit cbf95a0b117461473f05ab3cce4d01ba2b29e60a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/block/blkdebug.c b/block/blkdebug.c
index f51407de3f8..01b8e73bdae 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -449,6 +449,10 @@ static void error_callback_bh(void *opaque)
 static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb)
 {
     BlkdebugAIOCB *acb = container_of(blockacb, BlkdebugAIOCB, common);
+    if (acb->bh) {
+        qemu_bh_delete(acb->bh);
+        acb->bh = NULL;
+    }
     qemu_aio_release(acb);
 }