qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH v4 02/24] scsi-generic: Remove bogus double complete


From: Paolo Bonzini
Subject: [Qemu-devel] [PATCH v4 02/24] scsi-generic: Remove bogus double complete
Date: Mon, 23 May 2011 18:08:47 +0200

scsi-generic scsi_read_complete() should not -both- call the client
complete callback with SCSI_REASON_DATA -and- call
scsi_command_complete().  The former will cause the client to queue a
new read or write request, while the later will free the request data
structure, thus causing the new read or write request to use a
freed/stale structure when it completes.

This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5
installer.

Cc: Benjamin Herrenschmidt <address@hidden>
Cc: David Gibson <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: Christoph Hellwig <address@hidden>
---
 hw/scsi-generic.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index 9be1cca..102f1da 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -172,9 +172,11 @@ static void scsi_read_complete(void * opaque, int ret)
     DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len);
 
     r->len = -1;
-    r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
-    if (len == 0)
+    if (len == 0) {
         scsi_command_complete(r, 0);
+    } else {
+        r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
+    }
 }
 
 /* Read more data from scsi device into buffer.  */
-- 
1.7.4.4





reply via email to

[Prev in Thread] Current Thread [Next in Thread]