Re: [PATCH 2/4] thread-pool: Fix thread race

[Paolo Bonzini]

On 12/13/25 01:14, Marc Morcos wrote:

req->ret = ret;

Better use qatomic_set here---will fix it myself, thanks!

Paolo

-        /* Write ret before state.  */
-        smp_wmb();
-        req->state = THREAD_DONE;
+        /* _release to write ret before state.  */
+        qatomic_store_release(&req->state, THREAD_DONE);

qemu_bh_schedule(pool->completion_bh);

          qemu_mutex_lock(&pool->lock);
@@ -180,7 +184,8 @@ static void thread_pool_completion_bh(void *opaque)

restart:

      QLIST_FOREACH_SAFE(elem, &pool->head, all, next) {
-        if (elem->state != THREAD_DONE) {
+        /* _acquire to read state before ret.  */
+        if (qatomic_load_acquire(&elem->state) != THREAD_DONE) {
              continue;
          }

@@ -189,9 +194,6 @@ restart:

          QLIST_REMOVE(elem, all);

if (elem->common.cb) {

-            /* Read state before ret.  */
-            smp_rmb();
-
              /* Schedule ourselves in case elem->common.cb() calls aio_poll() 
to
               * wait for another request that completed at the same time.
               */
@@ -223,12 +225,12 @@ static void thread_pool_cancel(BlockAIOCB *acb)
      trace_thread_pool_cancel_aio(elem, elem->common.opaque);

QEMU_LOCK_GUARD(&pool->lock);

-    if (elem->state == THREAD_QUEUED) {
+    if (qatomic_read(&elem->state) == THREAD_QUEUED) {
          QTAILQ_REMOVE(&pool->request_list, elem, reqs);
          qemu_bh_schedule(pool->completion_bh);

- elem->state = THREAD_DONE;

-        elem->ret = -ECANCELED;
+        qatomic_set(&elem->ret, -ECANCELED);
+        qatomic_store_release(&elem->state, THREAD_DONE);
      }

}