diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2011-05-03 14:15:59 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2011-05-26 12:14:14 +0200 |
| commit | 40f16dd1279e7f26357b3c4b3838a89ffc6153da (patch) | |
| tree | 6c7921a74527c535f30d305da0c34663eda18a33 /hw | |
| parent | 5138efecf23471abcf7dedce1956918f4ba312e3 (diff) | |
| download | qemu-40f16dd1279e7f26357b3c4b3838a89ffc6153da.tar.gz | |
scsi-generic: Remove bogus double complete
scsi-generic scsi_read_complete() should not -both- call the client
complete callback with SCSI_REASON_DATA -and- call
scsi_command_complete(). The former will cause the client to queue a
new read or write request, while the later will free the request data
structure, thus causing the new read or write request to use a
freed/stale structure when it completes.
This patch fixes the bug, fixing a crash with scsi-generic & RHEL5.5
installer.
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/scsi-generic.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c index 9be1cca4c3..102f1dae09 100644 --- a/hw/scsi-generic.c +++ b/hw/scsi-generic.c @@ -172,9 +172,11 @@ static void scsi_read_complete(void * opaque, int ret) DPRINTF("Data ready tag=0x%x len=%d\n", r->req.tag, len); r->len = -1; - r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); - if (len == 0) + if (len == 0) { scsi_command_complete(r, 0); + } else { + r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len); + } } /* Read more data from scsi device into buffer. */ |