aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2016-09-16 00:36:58 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2016-11-28 15:11:17 +0100
commit75f19f8c3006970632303b49043b075dc4fe922e (patch)
treef71c491df99f2e8bc7fec88b839d603cce027180 /hw
parent00227fefd2059464cd2f59aed29944874c630e2f (diff)
downloadqemu-75f19f8c3006970632303b49043b075dc4fe922e.zip
qemu-75f19f8c3006970632303b49043b075dc4fe922e.tar.gz
qemu-75f19f8c3006970632303b49043b075dc4fe922e.tar.bz2
megasas: do not call pci_dma_unmap after having freed the frame once
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/scsi/megasas.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 52a4123..ca62952 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -461,9 +461,12 @@ static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
{
PCIDevice *p = PCI_DEVICE(s);
- pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
+ if (cmd->pa_size) {
+ pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
+ }
cmd->frame = NULL;
cmd->pa = 0;
+ cmd->pa_size = 0;
clear_bit(cmd->index, s->frame_map);
}