mirror of https://gitlab.com/qemu-project/qemu
scsi-disk: do not complete canceled UNMAP requests
Canceled requests should never be completed, and doing that could cause accesses to a NULL hba_private field. Cc: qemu-stable@nongnu.org Reported-by: Stefan Priebe <s.priebe@profihost.ag> Tested-by: Stefan Priebe <s.priebe@profihost.ag> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
6f6710aa99
commit
d0242eadc5
|
@ -1478,13 +1478,17 @@ static void scsi_unmap_complete(void *opaque, int ret)
|
||||||
uint32_t nb_sectors;
|
uint32_t nb_sectors;
|
||||||
|
|
||||||
r->req.aiocb = NULL;
|
r->req.aiocb = NULL;
|
||||||
|
if (r->req.io_canceled) {
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
if (ret < 0) {
|
if (ret < 0) {
|
||||||
if (scsi_handle_rw_error(r, -ret)) {
|
if (scsi_handle_rw_error(r, -ret)) {
|
||||||
goto done;
|
goto done;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (data->count > 0 && !r->req.io_canceled) {
|
if (data->count > 0) {
|
||||||
sector_num = ldq_be_p(&data->inbuf[0]);
|
sector_num = ldq_be_p(&data->inbuf[0]);
|
||||||
nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
|
nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
|
||||||
if (!check_lba_range(s, sector_num, nb_sectors)) {
|
if (!check_lba_range(s, sector_num, nb_sectors)) {
|
||||||
|
@ -1501,10 +1505,9 @@ static void scsi_unmap_complete(void *opaque, int ret)
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
scsi_req_complete(&r->req, GOOD);
|
||||||
|
|
||||||
done:
|
done:
|
||||||
if (data->count == 0) {
|
|
||||||
scsi_req_complete(&r->req, GOOD);
|
|
||||||
}
|
|
||||||
if (!r->req.io_canceled) {
|
if (!r->req.io_canceled) {
|
||||||
scsi_req_unref(&r->req);
|
scsi_req_unref(&r->req);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue