From patchwork Fri May 4 08:45:43 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 156837 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id DF9B2B6FDB for ; Fri, 4 May 2012 19:23:50 +1000 (EST) Received: from localhost ([::1]:46388 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQEAD-0008QX-NA for incoming@patchwork.ozlabs.org; Fri, 04 May 2012 04:46:57 -0400 Received: from eggs.gnu.org ([208.118.235.92]:49202) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQE9f-0006sw-CN for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SQE9a-0007KN-4Q for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:22 -0400 Received: from mail-pz0-f44.google.com ([209.85.210.44]:52841) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQE9Z-0007F2-S3 for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:18 -0400 Received: by mail-pz0-f44.google.com with SMTP id x6so2969373dac.31 for ; Fri, 04 May 2012 01:46:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:subject:date:message-id:x-mailer:in-reply-to :references; bh=NkdKLwYIrgbHG5hdI2L3I+yKXg6GfC09ZGCIYYW3ojo=; b=UKnLZ/BoC2t+H1fTHXu4v4XYYYBqXzZyQ/kp12lYpogn7EyFRDyvxFufp2bq1CHeiu Yd8b7Oej1mY6rKLvdlCB/MGuaK2f+4BvwmhIBjfMo1kMrQcWzWdKeTkomIlmdbVn2lVo LEVl8hheG4uD1tq6lnyZwai/ZZSe+7glP+kIRjgH0r0RvUFAvtHGz72AW2jjssMz03P2 moUTc70fztVve69AVnWLq3X+aNeIU8RFjC/BcHOFzgIKb4b5w/Mf0mzCYnqoXBEvs4gz 65+F44R9fWV6F3yZ0lHUuAPkoXAcvuRsUOfCIf7Y9fIgLcm5uuVMYN3ldU25Jt/ucE0S 2ZCg== Received: by 10.68.194.198 with SMTP id hy6mr16608398pbc.0.1336121176880; Fri, 04 May 2012 01:46:16 -0700 (PDT) Received: from yakj.usersys.redhat.com (93-34-182-16.ip50.fastwebnet.it. [93.34.182.16]) by mx.google.com with ESMTPS id gv2sm7975340pbc.73.2012.05.04.01.46.13 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 04 May 2012 01:46:15 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Fri, 4 May 2012 10:45:43 +0200 Message-Id: <1336121154-26517-4-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.7.9.3 In-Reply-To: <1336121154-26517-1-git-send-email-pbonzini@redhat.com> References: <1336121154-26517-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.85.210.44 Subject: [Qemu-devel] [PATCH 03/14] scsi: fix refcounting for reads X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Recently introduced FUA support also gave us a use-after-free of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced reference counting. The patch fixes this by making scsi_do_read look like a combination of scsi_*_complete + scsi_*_data. It does both a ref (like scsi_read_data) and an unref (like scsi_flush_complete). Reported-by: David Gibson Signed-off-by: Paolo Bonzini --- hw/scsi-disk.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index a029ab6..eca00a6 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -296,6 +296,13 @@ static void scsi_do_read(void *opaque, int ret) } } + if (r->req.io_canceled) { + return; + } + + /* The request is used as the AIO opaque value, so add a ref. */ + scsi_req_ref(&r->req); + if (r->req.sg) { dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ); r->req.resid -= r->req.sg->size;