From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:57882)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1boYVy-0004mB-NY
	for qemu-devel@nongnu.org; Mon, 26 Sep 2016 12:12:23 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1boYVx-0006Rx-Q5
	for qemu-devel@nongnu.org; Mon, 26 Sep 2016 12:12:22 -0400
Date: Mon, 26 Sep 2016 17:10:40 +0100
From: Stefan Hajnoczi <stefanha@gmail.com>
Message-ID: <20160926161040.GA26155@stefanha-x1.localdomain>
References: <1474575040-32079-1-git-send-email-jsnow@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="lrZ03NoBR/3+SXJZ"
Content-Disposition: inline
In-Reply-To: <1474575040-32079-1-git-send-email-jsnow@redhat.com>
Subject: Re: [Qemu-devel] [Qemu-block] [PATCH 0/1] ahci: fix ncq
 aiocb-related segfault
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: John Snow <jsnow@redhat.com>
Cc: qemu-block@nongnu.org, kwolf@redhat.com, pbonzini@redhat.com, qemu-stable@nongnu.org, qemu-devel@nongnu.org


--lrZ03NoBR/3+SXJZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 22, 2016 at 04:10:39PM -0400, John Snow wrote:
> Fix ncq_cb to prevent a segfault on sys_reset.
>=20
> John Snow (1):
>   ahci: clear aiocb in ncq_cb
>=20
>  hw/ide/ahci.c | 1 +
>  1 file changed, 1 insertion(+)
>=20
> --=20
> 2.7.4

Maybe worth adding as a clarification:

The issue is when bdrv_aio_cancel() is called after ncq_cb() was already
invoked.  The aiocb will be a dangling pointer.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

--lrZ03NoBR/3+SXJZ
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJX6UiAAAoJEJykq7OBq3PI7kEIAKsRoMBxmx0HvYY0ktxdUnvj
cHCDR4t4C7190COOzxjnEPQTCN28vZabGAkfEHYXtZivr7AoFynBLKQm9S8mDZ9a
6jR8CaxlWqbve9ec5uqB+l4rc94wX0wHwxcdQYmc9JAQu81RpJ7Q1Zyb3d8wgRF8
vLYLK1mUcpjlH8uFLiflJZ7rk+tVFRnGS6acBHJRC0DgejDgdIueBxniUqYoZkbE
YT3sTUFAWIqmdoQjpWGl21TyQ1VcGx06JCSXiYluYY7TMSlFDUydjpH64Mdx1Tvg
vEhDp8EwgBqjaWn86fkzh1s0PdujR+lVCp/PGV06dBg+lmlItGHXUzWZv2bMtWE=
=M+us
-----END PGP SIGNATURE-----

--lrZ03NoBR/3+SXJZ--