From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58981) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aK6rh-0007Wa-Ok for qemu-devel@nongnu.org; Fri, 15 Jan 2016 11:04:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aK6re-0003Gb-Mp for qemu-devel@nongnu.org; Fri, 15 Jan 2016 11:04:41 -0500 Received: from mail-wm0-x22f.google.com ([2a00:1450:400c:c09::22f]:34100) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aK6re-0003GV-Fw for qemu-devel@nongnu.org; Fri, 15 Jan 2016 11:04:38 -0500 Received: by mail-wm0-x22f.google.com with SMTP id u188so28949353wmu.1 for ; Fri, 15 Jan 2016 08:04:38 -0800 (PST) Received: from 640k.lan (94-39-195-126.adsl-ull.clienti.tiscali.it. [94.39.195.126]) by smtp.gmail.com with ESMTPSA id c15sm3103036wmd.19.2016.01.15.08.04.36 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Jan 2016 08:04:36 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 15 Jan 2016 17:04:16 +0100 Message-Id: <1452873871-138914-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1452873871-138914-1-git-send-email-pbonzini@redhat.com> References: <1452873871-138914-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 01/15] scsi: revert change to scsi_req_cancel_async and add assertions List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Fam Zheng noticed that the change in commit 36896bf ("scsi: always call notifier on async cancellation", 2015-12-16) could cause a leak of the request; scsi_req_cancel_async now calls scsi_req_ref multiple times for multiple cancellations, but there is only one call to scsi_req_cancel_complete. So revert the patch and instead assert that the problematic case (a call to scsi_req_cancel_async after the aiocb has been completed) cannot happen. Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-bus.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c index 00bddc9..378bf4d 100644 --- a/hw/scsi/scsi-bus.c +++ b/hw/scsi/scsi-bus.c @@ -1759,6 +1759,15 @@ void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier) if (notifier) { notifier_list_add(&req->cancel_notifiers, notifier); } + if (req->io_canceled) { + /* A blk_aio_cancel_async is pending; when it finishes, + * scsi_req_cancel_complete will be called and will + * call the notifier we just added. Just wait for that. + */ + assert(req->aiocb); + return; + } + /* Dropped in scsi_req_cancel_complete. */ scsi_req_ref(req); scsi_req_dequeue(req); req->io_canceled = true; @@ -1775,6 +1784,8 @@ void scsi_req_cancel(SCSIRequest *req) if (!req->enqueued) { return; } + assert(!req->io_canceled); + /* Dropped in scsi_req_cancel_complete. */ scsi_req_ref(req); scsi_req_dequeue(req); req->io_canceled = true; -- 1.8.3.1