diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2012-04-24 08:41:04 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2012-05-04 10:39:52 +0200 |
| commit | 31e8fd86f24b4eec8a1708d712bf0532460bb0a5 (patch) | |
| tree | 6a8e344234861da4aea779d6c95ee45e04a6df54 /hw/pm_smbus.h | |
| parent | 12a08998fe4f749af3622385521829a5143e6ff1 (diff) | |
scsi: fix refcounting for reads
Recently introduced FUA support also gave us a use-after-free
of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced
reference counting.
The patch fixes this by making scsi_do_read look like a combination
of scsi_*_complete + scsi_*_data. It does both a ref (like
scsi_read_data) and an unref (like scsi_flush_complete).
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/pm_smbus.h')
0 files changed, 0 insertions, 0 deletions