From patchwork Mon May 16 12:16:18 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 95714 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 3D7E2B6EE9 for ; Mon, 16 May 2011 22:17:21 +1000 (EST) Received: from localhost ([::1]:58125 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QLwje-00035H-7u for incoming@patchwork.ozlabs.org; Mon, 16 May 2011 08:17:18 -0400 Received: from eggs.gnu.org ([140.186.70.92]:45140) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QLwjG-00030Z-Ax for qemu-devel@nongnu.org; Mon, 16 May 2011 08:16:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QLwjF-0008RP-03 for qemu-devel@nongnu.org; Mon, 16 May 2011 08:16:54 -0400 Received: from mail-wy0-f173.google.com ([74.125.82.173]:49817) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QLwjE-0008Pu-Rz for qemu-devel@nongnu.org; Mon, 16 May 2011 08:16:52 -0400 Received: by mail-wy0-f173.google.com with SMTP id 42so3873836wyb.4 for ; Mon, 16 May 2011 05:16:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:from:to:cc:subject:date:message-id :x-mailer:in-reply-to:references; bh=FGuPDQ2MRflF7BWFxdBcvee7fmnQ/Ts0+gPa/rYZhV0=; b=XY0yJgnKH5DQKdlp/uxG9bHmv0RiXAJ3yyAS21Ee8cUKPM7kFhX9Xp4xSu4VIPX1m1 r5llj61t4nceboCyIMN3vn5FlLLZ+BOLXR9M4YJvbFt/Wr8jeeAC2NISz82gOeFiskVH mpZKDXEIZAaWSKBxUDNLrw3V6+lMqNScjLlt4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references; b=xg9uGmocGUqHuCYRhsrT1AwYANEyvWQmrlFm/aIbwqBfFCKBas4YsBLQhtCPpm6MpB fT997uWuAq02WjxVNLF/3wNef5x3n47YYMbGmspINxBHF+9qPALOdazJE3NhKhcMUSDX AwkBlz0JBdFELDGAqxCmkRSgLtF3655c1QxGk= Received: by 10.227.59.78 with SMTP id k14mr4236262wbh.102.1305548212586; Mon, 16 May 2011 05:16:52 -0700 (PDT) Received: from localhost.localdomain (93-34-184-88.ip51.fastwebnet.it [93.34.184.88]) by mx.google.com with ESMTPS id b20sm3105997wbb.67.2011.05.16.05.16.50 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 16 May 2011 05:16:51 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Mon, 16 May 2011 14:16:18 +0200 Message-Id: <1305548197-16196-3-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.7.4.4 In-Reply-To: <1305548197-16196-1-git-send-email-pbonzini@redhat.com> References: <1305548197-16196-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 74.125.82.173 Cc: David Gibson Subject: [Qemu-devel] [PATCH v2 02/21] scsi-generic: Remove bogus double complete X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org scsi-generic scsi_read_complete() should not -both- call the client complete callback with SCSI_REASON_DATA -and- call scsi_command_complete(). The former will cause the client to queue a new read or write request, while the later will free the request data structure, thus causing the new read or write request to use a freed/stale structure when it completes. This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5 installer. Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Paolo Bonzini --- hw/scsi-generic.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c index 9be1cca..102f1da 100644 --- a/hw/scsi-generic.c +++ b/hw/scsi-generic.c @@ -172,9 +172,11 @@ static void scsi_read_complete(void * opaque, int ret) DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len); r->len = -1; - r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); - if (len == 0) + if (len == 0) { scsi_command_complete(r, 0); + } else { + r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); + } } /* Read more data from scsi device into buffer. */