On Mon, Mar 15, 2021 at 06:40:12PM +0300, Vladimir Sementsov-Ogievskiy wrote: > 15.03.2021 09:06, Roman Kagan wrote: > > When the NBD connection is being torn down, the connection thread gets > > canceled and "detached", meaning it is about to get freed. > > > > If this happens while the connection coroutine yielded waiting for the > > connection thread to complete, when it resumes it may access the > > invalidated connection thread data. > > > > To prevent this, revalidate the ->connect_thread pointer in > > nbd_co_establish_connection_cancel before using after the the yield. > > > > Signed-off-by: Roman Kagan <rvka...@yandex-team.ru> > > Seems possible. Do you have a reproducer? Would be great to make an iotest.
It triggered on me in iotest 277, but seems to be timing-dependent. I'll see if I can do it reliable. Thanks, Roman.