From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40587) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c4rGd-00047k-4E for qemu-devel@nongnu.org; Thu, 10 Nov 2016 10:28:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c4rGc-0002RI-B9 for qemu-devel@nongnu.org; Thu, 10 Nov 2016 10:27:55 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35445) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c4rGc-0002Qw-5z for qemu-devel@nongnu.org; Thu, 10 Nov 2016 10:27:54 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5200F6A6DB for ; Thu, 10 Nov 2016 15:27:53 +0000 (UTC) Received: from donizetti.redhat.com (ovpn-112-19.ams2.redhat.com [10.36.112.19]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uAAFRp7a015057 for ; Thu, 10 Nov 2016 10:27:52 -0500 From: Paolo Bonzini Date: Thu, 10 Nov 2016 16:27:50 +0100 Message-Id: <20161110152751.4267-1-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH for-2.8] megasas: do not call pci_dma_unmap after having freed the frame once List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. >>From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini --- hw/scsi/megasas.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 52a4123..ca62952 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -461,9 +461,12 @@ static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd) { PCIDevice *p = PCI_DEVICE(s); - pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + if (cmd->pa_size) { + pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + } cmd->frame = NULL; cmd->pa = 0; + cmd->pa_size = 0; clear_bit(cmd->index, s->frame_map); } -- 2.9.3