[Qemu-devel] [PATCH] scsi-disk: fix crash on VERIFY command

[Zhang Qian]

From c2f1631132821d61e1942a8723ba596f91d3e672 Mon Sep 17 00:00:00 2001
From: Zhang Qian <address@hidden>
Date: Thu, 29 Dec 2016 20:00:01 +0800
Subject: [PATCH] scsi-disk: fix crash on VERIFY command Commit 166dbda
 "scsi-disk: fix VERIFY for scsi-block" add a process of VERIFY in
 scsi_block_dma_command. But, the cmd.mode of req is SCSI_XFER_NONE, the req
 is handled as a read operation. A verify command is not an actual read (we do
 not implement compare mode) and thus does not have an AIOCB attached. so, it
 will be crash in scsi_dma_complete. Commit ef8489d "scsi: avoid assertion
 failure on VERIFY command" is added to process verify command, so we treat
 verify command as a write operation.
Signed-off-by: Zhang Qian <address@hidden>
---
 hw/scsi/scsi-disk.c | 4 ++++
 1 file changed, 4 insertions(+)


diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index bdd1e5f..ab05bf9 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -2170,6 +2170,10 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, 
uint8_t *buf)
         if (!check_lba_range(s, r->req.cmd.lba, len)) {
             goto illegal_lba;
         }
+ if (command == VERIFY_10 || command == VERIFY_12 ||
+            command == VERIFY_16) {
+            r->req.cmd.mode = SCSI_XFER_TO_DEV;
+        }
         r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
         r->sector_count = len * (s->qdev.blocksize / 512);
         break;
--