commit fcd470d857a02ad76cd5a351a80bc0bb46588314
author Peter Lieven <pl@kamp.de> Tue Jun 10 09:52:16 2014 +0200
committer Paolo Bonzini <pbonzini@redhat.com> Wed Jun 18 08:47:10 2014 +0200
tree 1f999539ef1ad9a7c2acd1dfa3a9bd5b102c6197
parent efc6de0d0eb21bbd8fbc90da1faf7dd8ed9f5321

block/iscsi: fix potential segfault on early callback

it might happen in the future that a function directly invokes its callback.
In this case we end up in a segfault because the iTask is gone when the BH
is scheduled.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

block/iscsi.c

diff --git a/block/iscsi.c b/block/iscsi.c
index e64659f..09485fe 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -144,6 +144,7 @@
 static void iscsi_co_generic_bh_cb(void *opaque)
 {
     struct IscsiTask *iTask = opaque;
+    iTask->complete = 1;
     qemu_bh_delete(iTask->bh);
     qemu_coroutine_enter(iTask->co, NULL);
 }
@@ -151,6 +152,7 @@
 static void iscsi_retry_timer_expired(void *opaque)
 {
     struct IscsiTask *iTask = opaque;
+    iTask->complete = 1;
     if (iTask->co) {
         qemu_coroutine_enter(iTask->co, NULL);
     }
@@ -168,7 +170,6 @@
     struct IscsiTask *iTask = opaque;
     struct scsi_task *task = command_data;
 
-    iTask->complete = 1;
     iTask->status = status;
     iTask->do_retry = 0;
     iTask->task = task;
@@ -205,6 +206,8 @@
         iTask->bh = aio_bh_new(iTask->iscsilun->aio_context,
                                iscsi_co_generic_bh_cb, iTask);
         qemu_bh_schedule(iTask->bh);
+    } else {
+        iTask->complete = 1;
     }
 }