mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

megasas: do not call pci_dma_unmap after having freed the frame once

Browse Source 
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was
wrong because I trusted Coverity too much.  It turns out that there _is_ a
path through which cmd->frame can become NULL.  After megasas_handle_frame's
switch (md->frame->header.frame_cmd), megasas_init_firmware can be called.
From there, megasas_reset_frames will call megasas_unmap_frame which resets
cmd->frame = NULL.

However, there is another bug to fix in there, because megasas_unmap_frame
is called again after setting the command status.  In this case QEMU should
not do anything, instead it calls pci_dma_unmap again.  Harmless, but
better fix it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2016-09-16 00:36:58 +02:00
parent 00227fefd2
commit 75f19f8c30
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/scsi/megasas.c
View File

@ -461,9 +461,12 @@ static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
{
PCIDevice *p = PCI_DEVICE(s);
pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
if (cmd->pa_size) {
pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
}
cmd->frame = NULL;
cmd->pa = 0;
cmd->pa_size = 0;
clear_bit(cmd->index, s->frame_map);
}