falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi-disk: do not complete canceled UNMAP requests 

Canceled requests should never be completed, and doing that could cause
accesses to a NULL hba_private field.

Cc: qemu-stable@nongnu.org
Reported-by: Stefan Priebe <s.priebe@profihost.ag>
Tested-by: Stefan Priebe <s.priebe@profihost.ag>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d0242eadc5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
This commit is contained in:
Paolo Bonzini 2013-02-25 12:14:34 +01:00 committed by Michael Roth
parent f23ab037c7
commit 99b1f39bd2
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/scsi-disk.c
View File

@ -1493,13 +1493,17 @@ static void scsi_unmap_complete(void *opaque, int ret)
uint32_t nb_sectors; uint32_t nb_sectors;
r->req.aiocb = NULL; r->req.aiocb = NULL;
if (r->req.io_canceled) {
goto done;
}
if (ret < 0) { if (ret < 0) {
if (scsi_handle_rw_error(r, -ret)) { if (scsi_handle_rw_error(r, -ret)) {
goto done; goto done;
} }
} }
if (data->count > 0 && !r->req.io_canceled) { if (data->count > 0) {
sector_num = ldq_be_p(&data->inbuf[0]); sector_num = ldq_be_p(&data->inbuf[0]);
nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL; nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
if (!check_lba_range(s, sector_num, nb_sectors)) { if (!check_lba_range(s, sector_num, nb_sectors)) {
@ -1516,10 +1520,9 @@ static void scsi_unmap_complete(void *opaque, int ret)
return; return;
} }
scsi_req_complete(&r->req, GOOD);
done: done:
if (data->count == 0) {
scsi_req_complete(&r->req, GOOD);
}
if (!r->req.io_canceled) { if (!r->req.io_canceled) {
scsi_req_unref(&r->req); scsi_req_unref(&r->req);
} }