From 75f19f8c3006970632303b49043b075dc4fe922e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 16 Sep 2016 00:36:58 +0200 Subject: megasas: do not call pci_dma_unmap after having freed the frame once Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini --- hw/scsi/megasas.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'hw/scsi/megasas.c') diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 52a41239cf..ca62952941 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -461,9 +461,12 @@ static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd) { PCIDevice *p = PCI_DEVICE(s); - pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + if (cmd->pa_size) { + pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + } cmd->frame = NULL; cmd->pa = 0; + cmd->pa_size = 0; clear_bit(cmd->index, s->frame_map); } -- cgit v1.2.3