Commit e6aa5ba4 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

scsi-disk: fix double completion of failing passthrough requests 



If a command fails with a sense that scsi_sense_buf_to_errno converts to
ECANCELED/EAGAIN/ENOTCONN or with a unit attention, scsi_req_complete is
called twice.  This caused a crash.

Reported-by: default avatarWangguang <wang.guangA@h3c.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent a519e389

hw/scsi/scsi-disk.c

+11 −13
Original line number Diff line number Diff line
@@ -441,9 +441,18 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed) 
        }

        switch (error) {

        case 0:

            /* The command has run, no need to fake sense.  */

            /* A passthrough command has run and has produced sense data; check

             * whether the error has to be handled by the guest or should rather

             * pause the host.

             */

            assert(r->status && *r->status);

            error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));

            if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||

                error == 0)  {

                /* These errors are handled by guest. */

                scsi_req_complete(&r->req, *r->status);

                return true;

            }

            break;

        case ENOMEDIUM:

            scsi_check_condition(r, SENSE_CODE(NO_MEDIUM));
@@ -462,17 +471,6 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed) 
            break;

        }

    }

    if (!error) {

        assert(r->status && *r->status);

        error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));



        if (error == ECANCELED || error == EAGAIN || error == ENOTCONN ||

            error == 0)  {

            /* These errors are handled by guest. */

            scsi_req_complete(&r->req, *r->status);

            return true;

        }

    }



    blk_error_action(s->qdev.conf.blk, action, is_read, error);

    if (action == BLOCK_ERROR_ACTION_STOP) {