diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2013-02-25 12:14:34 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2013-04-02 10:54:35 -0500 |
| commit | 99b1f39bd28be0cf8f0505a55a98fa9beda23fa2 (patch) | |
| tree | 03f860aaa58bb771120346bda97e1547813ea6f6 | |
| parent | f23ab037c7ebd9ffe15526d0d2404194694ebad8 (diff) | |
scsi-disk: do not complete canceled UNMAP requests
Canceled requests should never be completed, and doing that could cause
accesses to a NULL hba_private field.
Cc: qemu-stable@nongnu.org
Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Tested-by: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d0242eadc5bba4f3abe34bc5d536bbfb81aa9891)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/scsi-disk.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index 6bc739d179..c9c983a5b7 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -1493,13 +1493,17 @@ static void scsi_unmap_complete(void *opaque, int ret) uint32_t nb_sectors; r->req.aiocb = NULL; + if (r->req.io_canceled) { + goto done; + } + if (ret < 0) { if (scsi_handle_rw_error(r, -ret)) { goto done; } } - if (data->count > 0 && !r->req.io_canceled) { + if (data->count > 0) { sector_num = ldq_be_p(&data->inbuf[0]); nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL; if (!check_lba_range(s, sector_num, nb_sectors)) { @@ -1516,10 +1520,9 @@ static void scsi_unmap_complete(void *opaque, int ret) return; } + scsi_req_complete(&r->req, GOOD); + done: - if (data->count == 0) { - scsi_req_complete(&r->req, GOOD); - } if (!r->req.io_canceled) { scsi_req_unref(&r->req); } |