From patchwork Mon Jan 30 22:29:47 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: AHCI: Fix port reset race From: Alexander Graf X-Patchwork-Id: 138667 Message-Id: <1327962588-5230-2-git-send-email-agraf@suse.de> To: kwolf@redhat.com Cc: Jan Kiszka , qemu-devel Developers Date: Mon, 30 Jan 2012 23:29:47 +0100 bdrv_aio_cancel() can trigger bdrv_aio_flush() which makes all aio that is currently in flight finish. So what we do is: port reset detect ncq in flight cancel ncq delete ncq sg list at which point we have double freed the sg list. Instead, with this patch we do: port reset detect ncq in flight cancel ncq check if we are really still in flight delete ncq sg list which makes things work and gets rid of the race. Signed-off-by: Alexander Graf --- hw/ide/ahci.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index 8869fd6..c2c168d 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -560,6 +560,11 @@ static void ahci_reset_port(AHCIState *s, int port) ncq_tfs->aiocb = NULL; } + /* Maybe we just finished the request thanks to bdrv_aio_cancel() */ + if (!ncq_tfs->used) { + continue; + } + qemu_sglist_destroy(&ncq_tfs->sglist); ncq_tfs->used = 0; }