10f5a72f70
When a request R is absorbed by request M, it is appended to the "mr_next" queue led by M, and is completed together with the completion of M, in virtio_blk_rw_complete. During DMA restart in virtio_blk_dma_restart_bh, requests in s->rq are parsed and submitted again, possibly with a stale req->mr_next. It could be a problem if the request merging in virtio_blk_handle_request hasn't refreshed every mr_next pointer, in which case, virtio_blk_rw_complete could walk through unexpected requests following the stale pointers. Fix this by unsetting the pointer in virtio_blk_rw_complete. It is safe because this req is either completed and freed right away, or it will be restarted and parsed from scratch out of the vq later. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
||
|---|---|---|
| .. | ||
| dataplane | ||
| block.c | ||
| cdrom.c | ||
| ecc.c | ||
| fdc.c | ||
| hd-geometry.c | ||
| m25p80.c | ||
| Makefile.objs | ||
| nand.c | ||
| nvme.c | ||
| nvme.h | ||
| onenand.c | ||
| pflash_cfi01.c | ||
| pflash_cfi02.c | ||
| tc58128.c | ||
| virtio-blk.c | ||
| xen_blkif.h | ||
| xen_disk.c | ||