From: Paolo Bonzini <pbonz...@redhat.com>
Canceled requests should never be completed, and doing that could cause
accesses to a NULL hba_private field.
Cc: qemu-sta...@nongnu.org
Reported-by: Stefan Priebe <s.pri...@profihost.ag>
Tested-by: Stefan Priebe <s.pri...@profihost.ag>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
(cherry picked from commit d0242eadc5bba4f3abe34bc5d536bbfb81aa9891)
Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com>
---
hw/scsi-disk.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 6bc739d..c9c983a 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1493,13 +1493,17 @@ static void scsi_unmap_complete(void *opaque, int ret)
uint32_t nb_sectors;
r->req.aiocb = NULL;
+ if (r->req.io_canceled) {
+ goto done;
+ }
+
if (ret < 0) {
if (scsi_handle_rw_error(r, -ret)) {
goto done;
}
}
- if (data->count > 0 && !r->req.io_canceled) {
+ if (data->count > 0) {
sector_num = ldq_be_p(&data->inbuf[0]);
nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
if (!check_lba_range(s, sector_num, nb_sectors)) {
@@ -1516,10 +1520,9 @@ static void scsi_unmap_complete(void *opaque, int ret)
return;
}
+ scsi_req_complete(&r->req, GOOD);
+
done:
- if (data->count == 0) {
- scsi_req_complete(&r->req, GOOD);
- }
if (!r->req.io_canceled) {
scsi_req_unref(&r->req);
}
--
1.7.9.5
