From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:47552)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <venkateshs@google.com>) id 1UOBP6-0003qS-Nn
	for qemu-devel@nongnu.org; Fri, 05 Apr 2013 14:30:27 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <venkateshs@google.com>) id 1UOBP3-0006EU-JW
	for qemu-devel@nongnu.org; Fri, 05 Apr 2013 14:30:24 -0400
Received: from mail-wg0-f48.google.com ([74.125.82.48]:34858)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <venkateshs@google.com>) id 1UOBP3-0006EB-Cd
	for qemu-devel@nongnu.org; Fri, 05 Apr 2013 14:30:21 -0400
Received: by mail-wg0-f48.google.com with SMTP id m15so4123498wgh.27
	for <qemu-devel@nongnu.org>; Fri, 05 Apr 2013 11:30:20 -0700 (PDT)
MIME-Version: 1.0
From: Venkatesh Srinivas <venkateshs@google.com>
Date: Fri, 5 Apr 2013 11:30:00 -0700
Message-ID: <CAHdzE-8SHPxC++f97T0fvfuZsbzeAMKudLjSypxod31W-vZauA@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [Qemu-devel] virtio-scsi WRITE_VERIFY crash
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

Hi,

When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
command has no IOCB.

The callpath is:
scsi_dma_complete
dma_complete
dma_bdrv_cb
dma_bdrv_io
dma_bdrv_read
scsi_do_read
bdrv_co_em_bh
aio_bh_poll
aio_poll.

At the assertion, we have a zero-element iovector and the request has
a status of -1.

-- vs;