aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi/scsi-bus.c
diff options
context:
space:
mode:
authorMaxim Levitsky <mlevitsk@redhat.com>2020-12-10 14:59:29 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2020-12-15 12:52:04 -0500
commitcfd4e36352d4426221aa94da44a172da1aaa741b (patch)
tree882248de2cf2c5dda57f34a8818d19470e076965 /hw/scsi/scsi-bus.c
parent835cbd8d44b62217b8774b39e1bfd314750c2c51 (diff)
downloadqemu-cfd4e36352d4426221aa94da44a172da1aaa741b.zip
qemu-cfd4e36352d4426221aa94da44a172da1aaa741b.tar.gz
qemu-cfd4e36352d4426221aa94da44a172da1aaa741b.tar.bz2
scsi: fix device removal race vs IO restart callback on resume
There is (mostly theoretical) race between removal of a scsi device and scsi_dma_restart_bh. It used to be easier to hit this race prior to my / Paulo's patch series that added rcu to scsi bus device handling code, but IMHO this race should still be possible to hit, at least in theory. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1854811 Fix it anyway with a patch that was proposed by Paulo in the above bugzilla. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20201210125929.1136390-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi/scsi-bus.c')
-rw-r--r--hw/scsi/scsi-bus.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index b901e70..edb5c34 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -170,6 +170,8 @@ static void scsi_dma_restart_bh(void *opaque)
scsi_req_unref(req);
}
aio_context_release(blk_get_aio_context(s->conf.blk));
+ /* Drop the reference that was acquired in scsi_dma_restart_cb */
+ object_unref(OBJECT(s));
}
void scsi_req_retry(SCSIRequest *req)
@@ -188,6 +190,8 @@ static void scsi_dma_restart_cb(void *opaque, int running, RunState state)
}
if (!s->bh) {
AioContext *ctx = blk_get_aio_context(s->conf.blk);
+ /* The reference is dropped in scsi_dma_restart_bh.*/
+ object_ref(OBJECT(s));
s->bh = aio_bh_new(ctx, scsi_dma_restart_bh, s);
qemu_bh_schedule(s->bh);
}