[56/56] ide: fix halted IO segfault at reset

Commit Message

Michael Roth Aug. 8, 2016, 9:04 p.m. UTC

From: John Snow <[e-mail]>

If one attempts to perform a system_reset after a failed IO request
that causes the VM to enter a paused state, QEMU will segfault trying
to free up the pending IO requests.

These requests have already been completed and freed, though, so all
we need to do is NULL them before we enter the paused state.

Existing AHCI tests verify that halted requests are still resumed
successfully after a STOP event.

Analyzed-by: Laszlo Ersek <[e-mail]>
Reviewed-by: Laszlo Ersek <[e-mail]>
Signed-off-by: John Snow <[e-mail]>
Message-id: [e-mail]
Signed-off-by: John Snow <[e-mail]>
(cherry picked from commit 87ac25fd1fed05a30a93d27dbeb2a4c4b83ec95f)
Signed-off-by: Michael Roth <[e-mail]>
---
 hw/ide/core.c | 1 +
 1 file changed, 1 insertion(+)

Comments

John Snow Aug. 9, 2016, 6:34 p.m. UTC | #1

Definitely add this one:

7f951b2d7765f68ae1e563c2fed44071ca774790 atapi: fix halted DMA reset

And maybe these:

16275edb342342625cd7e7ac2048436474465b50 macio: set res_count value to 0 
after non-block ATAPI DMA transfers
5839df7b71540a2af2580bb53ad1e2005bb175e6 ahci: fix sglist leak on retry
9d324b0e67c2b570df389c1361f591b95a4e4278 ahci: free irqs array


On 08/08/2016 05:04 PM, Michael Roth wrote:
> From: John Snow <[e-mail]>
>
> If one attempts to perform a system_reset after a failed IO request
> that causes the VM to enter a paused state, QEMU will segfault trying
> to free up the pending IO requests.
>
> These requests have already been completed and freed, though, so all
> we need to do is NULL them before we enter the paused state.
>
> Existing AHCI tests verify that halted requests are still resumed
> successfully after a STOP event.
>
> Analyzed-by: Laszlo Ersek <[e-mail]>
> Reviewed-by: Laszlo Ersek <[e-mail]>
> Signed-off-by: John Snow <[e-mail]>
> Message-id: [e-mail]
> Signed-off-by: John Snow <[e-mail]>
> (cherry picked from commit 87ac25fd1fed05a30a93d27dbeb2a4c4b83ec95f)
> Signed-off-by: Michael Roth <[e-mail]>
> ---
>  hw/ide/core.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/hw/ide/core.c b/hw/ide/core.c
> index 41e6a2d..e87dc57 100644
> --- a/hw/ide/core.c
> +++ b/hw/ide/core.c
> @@ -806,6 +806,7 @@ static void ide_dma_cb(void *opaque, int ret)
>      }
>      if (ret < 0) {
>          if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
> +            s->bus->dma->aiocb = NULL;
>              return;
>          }
>      }
>

Patch

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 41e6a2d..e87dc57 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -806,6 +806,7 @@  static void ide_dma_cb(void *opaque, int ret)
     }
     if (ret < 0) {
         if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
+            s->bus->dma->aiocb = NULL;
             return;
         }
     }