From d33e0ce213cec82a059f5e37667231200eb77325 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 25 May 2011 16:53:46 +0200 Subject: scsi-generic: do not use a stale aiocb If a request is canceled after it has been completed, scsi_cancel_io would pass a stale aiocb to bdrv_aio_cancel. Avoid this. Signed-off-by: Paolo Bonzini Cc: Christoph Hellwig --- hw/scsi-generic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c index f09458bec1..bd099835f4 100644 --- a/hw/scsi-generic.c +++ b/hw/scsi-generic.c @@ -91,6 +91,7 @@ static void scsi_command_complete(void *opaque, int ret) SCSIGenericReq *r = (SCSIGenericReq *)opaque; SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev); + r->req.aiocb = NULL; s->driver_status = r->io_header.driver_status; if (s->driver_status & SG_ERR_DRIVER_SENSE) s->senselen = r->io_header.sb_len_wr; @@ -163,6 +164,7 @@ static void scsi_read_complete(void * opaque, int ret) SCSIGenericReq *r = (SCSIGenericReq *)opaque; int len; + r->req.aiocb = NULL; if (ret) { DPRINTF("IO error ret %d\n", ret); scsi_command_complete(r, ret); @@ -229,6 +231,7 @@ static void scsi_write_complete(void * opaque, int ret) SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev); DPRINTF("scsi_write_complete() ret = %d\n", ret); + r->req.aiocb = NULL; if (ret) { DPRINTF("IO error\n"); scsi_command_complete(r, ret); -- cgit v1.2.3