From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=53498 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q6yUR-0005e8-1S for qemu-devel@nongnu.org; Tue, 05 Apr 2011 01:07:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q6yUP-0001Lx-Ha for qemu-devel@nongnu.org; Tue, 05 Apr 2011 01:07:42 -0400 Received: from ozlabs.org ([203.10.76.45]:41635) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q6yUP-0001LS-4C for qemu-devel@nongnu.org; Tue, 05 Apr 2011 01:07:41 -0400 From: David Gibson Date: Tue, 5 Apr 2011 15:07:31 +1000 Message-Id: <1301980051-20866-1-git-send-email-david@gibson.dropbear.id.au> Subject: [Qemu-devel] [PATCH] scsi-generic: Remove bogus double complete List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org From: Ben Herrenschmidt scsi-generic scsi_read_complete() should not -both- call the client complete callback with SCSI_REASON_DATA -and- call scsi_command_complete(). The former will cause the client to queue a new read or write request, while the later will free the request data structure, thus causing the new read or write request to use a freed/stale structure when it completes. This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5 installer. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: David Gibson --- hw/scsi-generic.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c index 9be1cca..c06f5df 100644 --- a/hw/scsi-generic.c +++ b/hw/scsi-generic.c @@ -173,8 +173,6 @@ static void scsi_read_complete(void * opaque, int ret) r->len = -1; r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); - if (len == 0) - scsi_command_complete(r, 0); } /* Read more data from scsi device into buffer. */ -- 1.7.1