From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:36276)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1RQas3-0006MW-QX
	for qemu-devel@nongnu.org; Wed, 16 Nov 2011 03:29:28 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1RQas1-0006NN-Re
	for qemu-devel@nongnu.org; Wed, 16 Nov 2011 03:29:27 -0500
Received: from mx1.redhat.com ([209.132.183.28]:9523)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <pbonzini@redhat.com>) id 1RQas1-0006N6-JW
	for qemu-devel@nongnu.org; Wed, 16 Nov 2011 03:29:25 -0500
Message-ID: <4EC3745F.2030309@redhat.com>
Date: Wed, 16 Nov 2011 09:29:19 +0100
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <1321376405-22776-1-git-send-email-pbonzini@redhat.com>
	<1321376405-22776-3-git-send-email-pbonzini@redhat.com>
	<CAEH94Lh2PnK0g1b8uGD8aHCcuKHcBEkXdG+VDmzvBckNKnXm7Q@mail.gmail.com>
In-Reply-To: <CAEH94Lh2PnK0g1b8uGD8aHCcuKHcBEkXdG+VDmzvBckNKnXm7Q@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 2/4] virtio-scsi: Add basic request
 processing infrastructure
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Zhi Yong Wu <zwu.kernel@gmail.com>
Cc: mst@redhat.com, qemu-devel@nongnu.org, stefanha@linux.vnet.ibm.com

On 11/16/2011 09:28 AM, Zhi Yong Wu wrote:
>> >  +static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
>> >  +{
>> >  +    VirtQueue *vq = req->vq;
>> >  +    virtqueue_push(vq,&req->elem, req->qsgl.size + req->elem.in_sg[0].iov_len);
>> >  +    qemu_sglist_destroy(&req->qsgl);
>> >  +    if (req->sreq) {
>> >  +        req->sreq->hba_private = NULL;
>> >  +        scsi_req_unref(req->sreq);
>> >  +    }
>> >  +    g_free(req);
>> >  +    virtio_notify(&req->dev->vdev, vq);
> req is used-after-free?

Yes, thanks for spotting it.

Paolo