From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:57328) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOXhH-000131-5z for qemu-devel@nongnu.org; Mon, 23 May 2011 12:09:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QOXhG-0001E5-1m for qemu-devel@nongnu.org; Mon, 23 May 2011 12:09:35 -0400 Received: from mail-px0-f173.google.com ([209.85.212.173]:53431) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOXhF-0001Dv-Od for qemu-devel@nongnu.org; Mon, 23 May 2011 12:09:33 -0400 Received: by pxi16 with SMTP id 16so3889922pxi.4 for ; Mon, 23 May 2011 09:09:33 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Mon, 23 May 2011 18:08:47 +0200 Message-Id: <1306166949-19698-3-git-send-email-pbonzini@redhat.com> In-Reply-To: <1306166949-19698-1-git-send-email-pbonzini@redhat.com> References: <1306166949-19698-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH v4 02/24] scsi-generic: Remove bogus double complete List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: hch@lst.de, David Gibson scsi-generic scsi_read_complete() should not -both- call the client complete callback with SCSI_REASON_DATA -and- call scsi_command_complete(). The former will cause the client to queue a new read or write request, while the later will free the request data structure, thus causing the new read or write request to use a freed/stale structure when it completes. This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5 installer. Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Paolo Bonzini Reviewed-by: Christoph Hellwig --- hw/scsi-generic.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c index 9be1cca..102f1da 100644 --- a/hw/scsi-generic.c +++ b/hw/scsi-generic.c @@ -172,9 +172,11 @@ static void scsi_read_complete(void * opaque, int ret) DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len); r->len = -1; - r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); - if (len == 0) + if (len == 0) { scsi_command_complete(r, 0); + } else { + r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); + } } /* Read more data from scsi device into buffer. */ -- 1.7.4.4