| commit | 75f19f8c3006970632303b49043b075dc4fe922e | |
| author | Paolo Bonzini <pbonzini@redhat.com> | |
| Thu, 15 Sep 2016 22:36:58 +0000 (16 00:36 +0200) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Mon, 28 Nov 2016 14:11:17 +0000 (28 15:11 +0100) | ||
| tree | f71c491df99f2e8bc7fec88b839d603cce027180 | treesnapshot (tar.gz zip) |
| parent | 00227fefd2059464cd2f59aed29944874c630e2f | commitdiff |
megasas: do not call pci_dma_unmap after having freed the frame once
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was
wrong because I trusted Coverity too much. It turns out that there _is_ a
path through which cmd->frame can become NULL. After megasas_handle_frame's
switch (md->frame->header.frame_cmd), megasas_init_firmware can be called.
From there, megasas_reset_frames will call megasas_unmap_frame which resets
cmd->frame = NULL.
However, there is another bug to fix in there, because megasas_unmap_frame
is called again after setting the command status. In this case QEMU should
not do anything, instead it calls pci_dma_unmap again. Harmless, but
better fix it.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was
wrong because I trusted Coverity too much. It turns out that there _is_ a
path through which cmd->frame can become NULL. After megasas_handle_frame's
switch (md->frame->header.frame_cmd), megasas_init_firmware can be called.
From there, megasas_reset_frames will call megasas_unmap_frame which resets
cmd->frame = NULL.
However, there is another bug to fix in there, because megasas_unmap_frame
is called again after setting the command status. In this case QEMU should
not do anything, instead it calls pci_dma_unmap again. Harmless, but
better fix it.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/scsi/megasas.c | diffblobblamehistory |