[qemu-xen stable-4.16] 9pfs: fix crash in v9fs_walk()

[patchbot@xxxxxxx]

commit abeee2a470f549b2730365f350416cc932340324
Author:     Christian Schoenebeck <qemu_oss@xxxxxxxxxxxxx>
AuthorDate: Wed Sep 1 18:15:10 2021 +0200
Commit:     Michael Roth <michael.roth@xxxxxxx>
CommitDate: Tue Dec 14 12:46:48 2021 -0600

    9pfs: fix crash in v9fs_walk()
    
    v9fs_walk() utilizes the v9fs_co_run_in_worker({...}) macro to run the
    supplied fs driver code block on a background worker thread.
    
    When either the 'Twalk' client request was interrupted or if the client
    requested fid for that 'Twalk' request caused a stat error then that
    fs driver code block was left by 'break' keyword, with the intention to
    return from worker thread back to main thread as well:
    
        v9fs_co_run_in_worker({
            if (v9fs_request_cancelled(pdu)) {
                err = -EINTR;
                break;
            }
            err = s->ops->lstat(&s->ctx, &dpath, &fidst);
            if (err < 0) {
                err = -errno;
                break;
            }
            ...
        });
    
    However that 'break;' statement also skipped the v9fs_co_run_in_worker()
    macro's final and mandatory
    
        /* re-enter back to qemu thread */
        qemu_coroutine_yield();
    
    call and thus caused the rest of v9fs_walk() to be continued being
    executed on the worker thread instead of main thread, eventually
    leading to a crash in the transport virtio transport driver.
    
    To fix this issue and to prevent the same error from happening again by
    other users of v9fs_co_run_in_worker() in future, auto wrap the supplied
    code block into its own
    
        do { } while (0);
    
    loop inside the 'v9fs_co_run_in_worker' macro definition.
    
    Full discussion and backtrace:
    https://lists.gnu.org/archive/html/qemu-devel/2021-08/msg05209.html
    https://lists.gnu.org/archive/html/qemu-devel/2021-09/msg00174.html
    
    Fixes: 8d6cb100731c4d28535adbf2a3c2d1f29be3fef4
    Signed-off-by: Christian Schoenebeck <qemu_oss@xxxxxxxxxxxxx>
    Cc: qemu-stable@xxxxxxxxxx
    Reviewed-by: Greg Kurz <groug@xxxxxxxx>
    Message-Id: <E1mLTBg-0002Bh-2D@xxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit f83df00900816476cca41bb536e4d532b297d76e)
    Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
---
 hw/9pfs/coth.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/9pfs/coth.h b/hw/9pfs/coth.h
index c51289903d..f83c7dda7b 100644
--- a/hw/9pfs/coth.h
+++ b/hw/9pfs/coth.h
@@ -51,7 +51,9 @@
          */                                                             \
         qemu_coroutine_yield();                                         \
         qemu_bh_delete(co_bh);                                          \
-        code_block;                                                     \
+        do {                                                            \
+            code_block;                                                 \
+        } while (0);                                                    \
         /* re-enter back to qemu thread */                              \
         qemu_coroutine_yield();                                         \
     } while (0)
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.16