On Wed, 10 Jun 2026 13:34:04 +0100, Daniel P. Berrangé <[email protected]> 
wrote:
> Convert monitor_accept_input from a oneshot BH (aio_bh_schedule_oneshot)
> to a persistent BH (aio_bh_new + qemu_bh_schedule).  Oneshot BHs cannot
> be cancelled, so monitor_resume() racing with destruction would schedule
> a callback against memory that monitor_qmp_destroy() is about to free.
> A persistent BH can be deleted during destruction, cancelling any
> pending schedule.
> 
> [...]

Reviewed-by: Marc-André Lureau <[email protected]>

-- 
Marc-André Lureau <[email protected]>

Reply via email to