sheepdog: Fix crash in co_read_response()

This fixes a regression introduced in commit 9d456654.

aio_co_wake() can only be used to reenter a coroutine that was already
previously entered, otherwise co->ctx is uninitialised and we access
garbage. Using it immediately after qemu_coroutine_create() like in
co_read_response() is wrong and causes segfaults.

Replace the call with aio_co_enter(), which gets an explicit AioContext
parameter and works even for new coroutines.

Signed-off-by: Kevin Wolf <[email protected]>
Tested-by: Kashyap Chamarthy <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Message-id: 1491919733[email protected]
Signed-off-by: Peter Maydell <[email protected]>

diff --git a/block/sheepdog.c b/block/sheepdog.c
index 14d63272093524dc224a22507a5620db508dfbdb..fb9203e9be37eaab274d20653d8ce804d036c5b4 100644 (file)
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -942,7 +942,7 @@ static void co_read_response(void *opaque)
         s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
     }
 
-    aio_co_wake(s->co_recv);
+    aio_co_enter(s->aio_context, s->co_recv);
 }
 
 static void co_write_request(void *opaque)