From e6aa5ba4ac423dd282c831402110970ee278392e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Sat, 13 Oct 2018 11:49:16 +0200 Subject: scsi-disk: fix double completion of failing passthrough requests If a command fails with a sense that scsi_sense_buf_to_errno converts to ECANCELED/EAGAIN/ENOTCONN or with a unit attention, scsi_req_complete is called twice. This caused a crash. Reported-by: Wangguang Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-disk.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) (limited to 'hw/scsi/scsi-disk.c') diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index c43163cef4..4074d7c2bf 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -441,9 +441,18 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed) } switch (error) { case 0: - /* The command has run, no need to fake sense. */ + /* A passthrough command has run and has produced sense data; check + * whether the error has to be handled by the guest or should rather + * pause the host. + */ assert(r->status && *r->status); - scsi_req_complete(&r->req, *r->status); + error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense)); + if (error == ECANCELED || error == EAGAIN || error == ENOTCONN || + error == 0) { + /* These errors are handled by guest. */ + scsi_req_complete(&r->req, *r->status); + return true; + } break; case ENOMEDIUM: scsi_check_condition(r, SENSE_CODE(NO_MEDIUM)); @@ -462,17 +471,6 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed) break; } } - if (!error) { - assert(r->status && *r->status); - error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense)); - - if (error == ECANCELED || error == EAGAIN || error == ENOTCONN || - error == 0) { - /* These errors are handled by guest. */ - scsi_req_complete(&r->req, *r->status); - return true; - } - } blk_error_action(s->qdev.conf.blk, action, is_read, error); if (action == BLOCK_ERROR_ACTION_STOP) { -- cgit v1.2.3-55-g7522 From 40dce4ee61c68395f6d463fae792f61b7c003bce Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Sat, 13 Oct 2018 11:52:34 +0200 Subject: scsi-disk: fix rerror/werror=ignore rerror=ignore was returning true from scsi_handle_rw_error but the callers were not calling scsi_req_complete when rerror=ignore returns true (this is the correct thing to do when true is returned after executing a passthrough command). Fix this by calling it in scsi_handle_rw_error. Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-disk.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'hw/scsi/scsi-disk.c') diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index 4074d7c2bf..e2c5408aa2 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -473,10 +473,15 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int error, bool acct_failed) } blk_error_action(s->qdev.conf.blk, action, is_read, error); + if (action == BLOCK_ERROR_ACTION_IGNORE) { + scsi_req_complete(&r->req, 0); + return true; + } + if (action == BLOCK_ERROR_ACTION_STOP) { scsi_req_retry(&r->req); } - return action != BLOCK_ERROR_ACTION_IGNORE; + return false; } static void scsi_write_complete_noio(SCSIDiskReq *r, int ret) -- cgit v1.2.3-55-g7522