Commit 38d8dfa1 authored by Kevin Wolf's avatar Kevin Wolf
Browse files

ide: Fix ide_dma_cancel 



When cancelling a request, bdrv_aio_cancel may decide that it waits for
completion of a request rather than for cancellation. IDE therefore can't
abandon its DMA status before calling bdrv_aio_cancel; otherwise the callback
of a completed request would use invalid data.

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent 20be49e4

hw/ide/core.c

+4 −4
Original line number Diff line number Diff line
@@ -2838,10 +2838,6 @@ static void ide_dma_restart(IDEState *s, int is_read) 
void ide_dma_cancel(BMDMAState *bm)

{

    if (bm->status & BM_STATUS_DMAING) {

        bm->status &= ~BM_STATUS_DMAING;

        /* cancel DMA request */

        bm->unit = -1;

        bm->dma_cb = NULL;

        if (bm->aiocb) {

#ifdef DEBUG_AIO

            printf("aio_cancel\n");
@@ -2849,6 +2845,10 @@ void ide_dma_cancel(BMDMAState *bm) 
            bdrv_aio_cancel(bm->aiocb);

            bm->aiocb = NULL;

        }

        bm->status &= ~BM_STATUS_DMAING;

        /* cancel DMA request */

        bm->unit = -1;

        bm->dma_cb = NULL;

    }

}