1 files changed, 36 insertions, 17 deletions

diff --git a/block/nbd.c b/block/nbd.c
index 524c9cf412..56dbf6ef86 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -150,11 +150,19 @@ static int nbd_have_request(void *opaque)
 static void nbd_reply_ready(void *opaque)
 {
     BDRVNBDState *s = opaque;
-    int i;
+    uint64_t i;
+    int ret;
 
     if (s->reply.handle == 0) {
-        /* No reply already in flight.  Fetch a header.  */
-        if (nbd_receive_reply(s->sock, &s->reply) < 0) {
+        /* No reply already in flight.  Fetch a header.  It is possible
+         * that another thread has done the same thing in parallel, so
+         * the socket is not readable anymore.
+         */
+        ret = nbd_receive_reply(s->sock, &s->reply);
+        if (ret == -EAGAIN) {
+            return;
+        }
+        if (ret < 0) {
             s->reply.handle = 0;
             goto fail;
         }
@@ -164,6 +172,10 @@ static void nbd_reply_ready(void *opaque)
      * handler acts as a synchronization point and ensures that only
      * one coroutine is called until the reply finishes.  */
     i = HANDLE_TO_INDEX(s, s->reply.handle);
+    if (i >= MAX_NBD_REQUESTS) {
+        goto fail;
+    }
+
     if (s->recv_coroutine[i]) {
         qemu_coroutine_enter(s->recv_coroutine[i], NULL);
         return;
@@ -193,11 +205,10 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
     qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write,
                             nbd_have_request, s);
     rc = nbd_send_request(s->sock, request);
-    if (rc != -1 && iov) {
+    if (rc >= 0 && iov) {
         ret = qemu_co_sendv(s->sock, iov, request->len, offset);
         if (ret != request->len) {
-            errno = -EIO;
-            rc = -1;
+            return -EIO;
         }
     }
     qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
@@ -256,7 +267,7 @@ static int nbd_establish_connection(BlockDriverState *bs)
     }
 
     /* Failed to establish connection */
-    if (sock == -1) {
+    if (sock < 0) {
         logout("Failed to establish connection to NBD server\n");
         return -errno;
     }
@@ -264,10 +275,10 @@ static int nbd_establish_connection(BlockDriverState *bs)
     /* NBD handshake */
     ret = nbd_receive_negotiate(sock, s->export_name, &s->nbdflags, &size,
                                 &blocksize);
-    if (ret == -1) {
+    if (ret < 0) {
         logout("Failed to negotiate with the NBD server\n");
         closesocket(sock);
-        return -errno;
+        return ret;
     }
 
     /* Now that we're connected, set the socket to be non-blocking and
@@ -327,14 +338,16 @@ static int nbd_co_readv_1(BlockDriverState *bs, int64_t sector_num,
     BDRVNBDState *s = bs->opaque;
     struct nbd_request request;
     struct nbd_reply reply;
+    ssize_t ret;
 
     request.type = NBD_CMD_READ;
     request.from = sector_num * 512;
     request.len = nb_sectors * 512;
 
     nbd_coroutine_start(s, &request);
-    if (nbd_co_send_request(s, &request, NULL, 0) == -1) {
-        reply.error = errno;
+    ret = nbd_co_send_request(s, &request, NULL, 0);
+    if (ret < 0) {
+        reply.error = -ret;
     } else {
         nbd_co_receive_reply(s, &request, &reply, qiov->iov, offset);
     }
@@ -350,6 +363,7 @@ static int nbd_co_writev_1(BlockDriverState *bs, int64_t sector_num,
     BDRVNBDState *s = bs->opaque;
     struct nbd_request request;
     struct nbd_reply reply;
+    ssize_t ret;
 
     request.type = NBD_CMD_WRITE;
     if (!bdrv_enable_write_cache(bs) && (s->nbdflags & NBD_FLAG_SEND_FUA)) {
@@ -360,8 +374,9 @@ static int nbd_co_writev_1(BlockDriverState *bs, int64_t sector_num,
     request.len = nb_sectors * 512;
 
     nbd_coroutine_start(s, &request);
-    if (nbd_co_send_request(s, &request, qiov->iov, offset) == -1) {
-        reply.error = errno;
+    ret = nbd_co_send_request(s, &request, qiov->iov, offset);
+    if (ret < 0) {
+        reply.error = -ret;
     } else {
         nbd_co_receive_reply(s, &request, &reply, NULL, 0);
     }
@@ -412,6 +427,7 @@ static int nbd_co_flush(BlockDriverState *bs)
     BDRVNBDState *s = bs->opaque;
     struct nbd_request request;
     struct nbd_reply reply;
+    ssize_t ret;
 
     if (!(s->nbdflags & NBD_FLAG_SEND_FLUSH)) {
         return 0;
@@ -426,8 +442,9 @@ static int nbd_co_flush(BlockDriverState *bs)
     request.len = 0;
 
     nbd_coroutine_start(s, &request);
-    if (nbd_co_send_request(s, &request, NULL, 0) == -1) {
-        reply.error = errno;
+    ret = nbd_co_send_request(s, &request, NULL, 0);
+    if (ret < 0) {
+        reply.error = -ret;
     } else {
         nbd_co_receive_reply(s, &request, &reply, NULL, 0);
     }
@@ -441,6 +458,7 @@ static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,
     BDRVNBDState *s = bs->opaque;
     struct nbd_request request;
     struct nbd_reply reply;
+    ssize_t ret;
 
     if (!(s->nbdflags & NBD_FLAG_SEND_TRIM)) {
         return 0;
@@ -450,8 +468,9 @@ static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,
     request.len = nb_sectors * 512;
 
     nbd_coroutine_start(s, &request);
-    if (nbd_co_send_request(s, &request, NULL, 0) == -1) {
-        reply.error = errno;
+    ret = nbd_co_send_request(s, &request, NULL, 0);
+    if (ret < 0) {
+        reply.error = -ret;
     } else {
         nbd_co_receive_reply(s, &request, &reply, NULL, 0);
     }