From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50415) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cBUcK-0002HT-T0 for qemu-devel@nongnu.org; Mon, 28 Nov 2016 17:41:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cBUcI-0002qI-AN for qemu-devel@nongnu.org; Mon, 28 Nov 2016 17:41:44 -0500 Received: from mail-wj0-f196.google.com ([209.85.210.196]:33188) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cBUcI-0002q7-49 for qemu-devel@nongnu.org; Mon, 28 Nov 2016 17:41:42 -0500 Received: by mail-wj0-f196.google.com with SMTP id kp2so15939546wjc.0 for ; Mon, 28 Nov 2016 14:41:41 -0800 (PST) Received: from 640k.lan (94-39-142-71.adsl-ull.clienti.tiscali.it. [94.39.142.71]) by smtp.gmail.com with ESMTPSA id x5sm64602508wje.36.2016.11.28.14.40.39 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Nov 2016 14:40:39 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Mon, 28 Nov 2016 23:40:32 +0100 Message-Id: <1480372837-109736-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1480372837-109736-1-git-send-email-pbonzini@redhat.com> References: <1480372837-109736-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 1/6] megasas: do not call pci_dma_unmap after having freed the frame once List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. >>From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini --- hw/scsi/megasas.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 52a4123..ca62952 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -461,9 +461,12 @@ static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd) { PCIDevice *p = PCI_DEVICE(s); - pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + if (cmd->pa_size) { + pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0); + } cmd->frame = NULL; cmd->pa = 0; + cmd->pa_size = 0; clear_bit(cmd->index, s->frame_map); } -- 1.8.3.1