From patchwork Mon May 16 16:26:40 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 95782 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 89B0CB6EE6 for ; Tue, 17 May 2011 02:26:58 +1000 (EST) Received: from localhost ([::1]:57864 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QM0dB-0000jC-Ou for incoming@patchwork.ozlabs.org; Mon, 16 May 2011 12:26:53 -0400 Received: from eggs.gnu.org ([140.186.70.92]:51746) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QM0d4-0000iv-Bk for qemu-devel@nongnu.org; Mon, 16 May 2011 12:26:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QM0d3-0005Xs-5t for qemu-devel@nongnu.org; Mon, 16 May 2011 12:26:46 -0400 Received: from mail-wy0-f173.google.com ([74.125.82.173]:49247) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QM0d3-0005Xm-0p for qemu-devel@nongnu.org; Mon, 16 May 2011 12:26:45 -0400 Received: by wyb42 with SMTP id 42so4095971wyb.4 for ; Mon, 16 May 2011 09:26:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:newsgroups:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=fV88ZZ+mE23ZXxDLkr6OmhPZ5v24L9NOBlZQ9BAj8rQ=; b=qQ9yVTtK9WTDbe6djFzbt4Lsyn/fHhWumk/i7TXlQbsPxpkYrFnZI33lXsOjHWsz60 A2XQGXzLtVRyzMGCz47k6bTuTSYsy9szM1/C3YnLipbCXgJbMXIFgs+lvPhKjt7tKayN u58LiBH+9Qx/D6YE7wHwkCdCGPTyeymb7ATAw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:newsgroups:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; b=ldv5l8nTVsjFzyhUjQkSLh12cAM5AXUtqkzg3k4c/O3V0pkLjFLWQ1B/i+lGqheqha LX99xxlbiBJbH43Ny3KZtZvfdV7SzLifbv4tIfJo0yMX9UZUsF6+d2ZQ/CHbwLyYYbUq d60PtIghjzg9WAVjBCJdC+vI0d56X06u+rNuk= Received: by 10.227.13.135 with SMTP id c7mr1045648wba.111.1305563204000; Mon, 16 May 2011 09:26:44 -0700 (PDT) Received: from yakj.usersys.redhat.com (93-34-184-88.ip51.fastwebnet.it [93.34.184.88]) by mx.google.com with ESMTPS id o6sm3244631wbo.20.2011.05.16.09.26.42 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 16 May 2011 09:26:43 -0700 (PDT) Message-ID: <4DD15040.7030809@redhat.com> Date: Mon, 16 May 2011 18:26:40 +0200 From: Paolo Bonzini User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc14 Lightning/1.0b3pre Mnenhy/0.8.3 Thunderbird/3.1.10 MIME-Version: 1.0 Newsgroups: gmane.comp.emulators.qemu To: Kevin Wolf References: <1288876539-8300-1-git-send-email-kwolf@redhat.com> <1288876539-8300-4-git-send-email-kwolf@redhat.com> <20110516111926.GA7928@elie> <4DD13EFF.80000@redhat.com> <20110516154301.GA25150@elie> <4DD149A2.6020801@redhat.com> In-Reply-To: <4DD149A2.6020801@redhat.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 74.125.82.173 Cc: Jonathan Nieder , Stefan Hajnoczi , qemu-devel@nongnu.org Subject: Re: [Qemu-devel] [regression] qemu-system-arm: segfault in lsi_do_command X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org On 05/16/2011 05:58 PM, Kevin Wolf wrote: > Thanks. Still doesn't make much sense to me, the patch shouldn't change > anything with respect to a malloc, but I can reproduce a segfault now. I > think I'll have a closer look tomorrow. This fixes it on top of my SCSI refactoring series. Should I send v3 with this one squashed in appropriately? Or should this be sent later? Paolo diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c index 2f0ffda..57cfc87 100644 --- a/hw/scsi-bus.c +++ b/hw/scsi-bus.c @@ -167,11 +167,17 @@ int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len) int32_t scsi_req_enqueue(SCSIRequest *req, uint8_t *buf) { + int32_t rc; assert(!req->enqueued); scsi_req_ref(req); req->enqueued = true; QTAILQ_INSERT_TAIL(&req->dev->requests, req, next); - return req->dev->info->send_command(req, buf); + + /* Make sure the request doesn't disappear under send_command's feet. */ + scsi_req_ref(req); + rc = req->dev->info->send_command(req, buf); + scsi_req_unref(req); + return rc; } static void scsi_req_dequeue(SCSIRequest *req)