scsi: fix refcounting for reads
Recently introduced FUA support also gave us a use-after-free of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced reference counting. The patch fixes this by making scsi_do_read look like a combination of scsi_*_complete + scsi_*_data. It does both a ref (like scsi_read_data) and an unref (like scsi_flush_complete). Reported-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
12a08998fe
commit
31e8fd86f2
|
@ -296,6 +296,13 @@ static void scsi_do_read(void *opaque, int ret)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (r->req.io_canceled) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* The request is used as the AIO opaque value, so add a ref. */
|
||||||
|
scsi_req_ref(&r->req);
|
||||||
|
|
||||||
if (r->req.sg) {
|
if (r->req.sg) {
|
||||||
dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);
|
dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);
|
||||||
r->req.resid -= r->req.sg->size;
|
r->req.resid -= r->req.sg->size;
|
||||||
|
|
Loading…
Reference in a new issue