Thanks for your reply. In other similar situation, we will get the StacksecurityManager lock before get other driver's lock to keep the use of the security drivers is internally serialized(in 'virSecurityManagerGenLabel'). In the functions of this patch, we haven't get the StacksecurityManager lock but get the lock of other drivers in qemuSecurityGetBaseLabel. I think it's the reason of this problem. And I think 'virSecurityManagerGetNested' is used to get a list of other SecurityManager, i'm not sure whether we need a lock here.