david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi-generic: Remove bogus double complete

Browse Source 
scsi-generic scsi_read_complete() should not -both- call the client
complete callback with SCSI_REASON_DATA -and- call
scsi_command_complete().  The former will cause the client to queue a
new read or write request, while the later will free the request data
structure, thus causing the new read or write request to use a
freed/stale structure when it completes.

This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5
installer.

Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
Paolo Bonzini 2011-05-03 14:15:59 +02:00
parent 5138efecf2
commit 40f16dd127
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/scsi-generic.c
View File

@ -172,9 +172,11 @@ static void scsi_read_complete(void * opaque, int ret)
DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len); DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len);
r->len = -1; r->len = -1;
r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); if (len == 0) {
if (len == 0)
scsi_command_complete(r, 0); scsi_command_complete(r, 0);
} else {
r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);
}
} }
/* Read more data from scsi device into buffer. */ /* Read more data from scsi device into buffer. */