From 31e8fd86f24b4eec8a1708d712bf0532460bb0a5 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 24 Apr 2012 08:41:04 +0200 Subject: [PATCH] scsi: fix refcounting for reads Recently introduced FUA support also gave us a use-after-free of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced reference counting. The patch fixes this by making scsi_do_read look like a combination of scsi_*_complete + scsi_*_data. It does both a ref (like scsi_read_data) and an unref (like scsi_flush_complete). Reported-by: David Gibson Signed-off-by: Paolo Bonzini --- hw/scsi-disk.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index a029ab6e84..eca00a6b1d 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -296,6 +296,13 @@ static void scsi_do_read(void *opaque, int ret) } } + if (r->req.io_canceled) { + return; + } + + /* The request is used as the AIO opaque value, so add a ref. */ + scsi_req_ref(&r->req); + if (r->req.sg) { dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ); r->req.resid -= r->req.sg->size;