david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scsi-disk: fix double completion of failing passthrough requests

Browse Source 
If a command fails with a sense that scsi_sense_buf_to_errno converts to
ECANCELED/EAGAIN/ENOTCONN or with a unit attention, scsi_req_complete is
called twice.  This caused a crash.

Reported-by: Wangguang <wang.guangA@h3c.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2018-10-13 11:49:16 +02:00
parent a519e38944
commit e6aa5ba4ac
1 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
hw/scsi/scsi-disk.c
View File

@ -441,9 +441,18 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
} }
switch (error) { switch (error) {
case 0: case 0:
/* The command has run, no need to fake sense. */ /* A passthrough command has run and has produced sense data; check
* whether the error has to be handled by the guest or should rather
* pause the host.
*/
assert(r->status && *r->status); assert(r->status && *r->status);
error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||
error == 0) {
/* These errors are handled by guest. */
scsi_req_complete(&r->req, *r->status); scsi_req_complete(&r->req, *r->status);
return true;
}
break; break;
case ENOMEDIUM: case ENOMEDIUM:
scsi_check_condition(r, SENSE_CODE(NO_MEDIUM)); scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
@ -462,17 +471,6 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed)
break; break;
} }
} }
if (!error) {
assert(r->status && *r->status);
error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||
error == 0) {
/* These errors are handled by guest. */
scsi_req_complete(&r->req, *r->status);
return true;
}
}
blk_error_action(s->qdev.conf.blk, action, is_read, error); blk_error_action(s->qdev.conf.blk, action, is_read, error);
if (action == BLOCK_ERROR_ACTION_STOP) { if (action == BLOCK_ERROR_ACTION_STOP) {