Patchwork [14/37] scsi-disk: do not complete canceled UNMAP requests

login
register
mail settings
Submitter Michael Roth
Date April 2, 2013, 9:45 p.m.
Message ID <1364939142-30066-15-git-send-email-mdroth@linux.vnet.ibm.com>
Download mbox | patch
Permalink /patch/233179/
State New
Headers show

Comments

Michael Roth - April 2, 2013, 9:45 p.m.
From: Paolo Bonzini <pbonzini@redhat.com>

Canceled requests should never be completed, and doing that could cause
accesses to a NULL hba_private field.

Cc: qemu-stable@nongnu.org
Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Tested-by: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d0242eadc5bba4f3abe34bc5d536bbfb81aa9891)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---
 hw/scsi-disk.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Patch

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 6bc739d..c9c983a 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1493,13 +1493,17 @@  static void scsi_unmap_complete(void *opaque, int ret)
     uint32_t nb_sectors;
 
     r->req.aiocb = NULL;
+    if (r->req.io_canceled) {
+        goto done;
+    }
+
     if (ret < 0) {
         if (scsi_handle_rw_error(r, -ret)) {
             goto done;
         }
     }
 
-    if (data->count > 0 && !r->req.io_canceled) {
+    if (data->count > 0) {
         sector_num = ldq_be_p(&data->inbuf[0]);
         nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
         if (!check_lba_range(s, sector_num, nb_sectors)) {
@@ -1516,10 +1520,9 @@  static void scsi_unmap_complete(void *opaque, int ret)
         return;
     }
 
+    scsi_req_complete(&r->req, GOOD);
+
 done:
-    if (data->count == 0) {
-        scsi_req_complete(&r->req, GOOD);
-    }
     if (!r->req.io_canceled) {
         scsi_req_unref(&r->req);
     }