[Xen-changelog] [qemu-xen-traditional stable-4.6] ide: cancel dma operations on command abort or error

[patchbot@xxxxxxx]

commit 56464b49335de2a452b8bff44effe72c2d00a8df
Author:     Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
AuthorDate: Wed Dec 10 02:36:23 2014 -0800
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Fri Oct 16 16:52:06 2015 +0100

    ide: cancel dma operations on command abort or error
    
    Otherwise, a guest can cause Qemu to reuse an active aio structure.
    
    Signed-off-by: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 hw/ide.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/ide.c b/hw/ide.c
index 7b84d1b..3636611 100644
--- a/hw/ide.c
+++ b/hw/ide.c
@@ -919,8 +919,10 @@ static void ide_set_signature(IDEState *s)
     }
 }
 
+static void ide_dma_cancel(BMDMAState *bm);
 static inline void ide_abort_command(IDEState *s)
 {
+    if (s->bmdma) ide_dma_cancel(s->bmdma);
     s->status = READY_STAT | ERR_STAT;
     s->error = ABRT_ERR;
 }
@@ -1098,6 +1100,7 @@ static void dma_buf_commit(IDEState *s, int is_write)
 
 static void ide_dma_error(IDEState *s)
 {
+    if (s->bmdma) ide_dma_cancel(s->bmdma);
     ide_transfer_stop(s);
     s->error = ABRT_ERR;
     s->status = READY_STAT | ERR_STAT;
@@ -1230,7 +1233,7 @@ static void ide_read_dma_cb(void *opaque, int ret)
        return;
     }
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
+    if (!s || !s->bs) return; /* ouch! (see ide_dma_error & ide_flush_cb) */
 
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
@@ -1371,7 +1374,7 @@ static void ide_write_dma_cb(void *opaque, int ret)
             return;
     }
 
-    if (!s->bs) return; /* ouch! (see ide_flush_cb) */
+    if (!s || !s->bs) return; /* ouch! (see ide_dma_error & ide_flush_cb) */
 
     n = s->io_buffer_size >> 9;
     sector_num = ide_get_sector(s);
--
generated by git-patchbot for /home/xen/git/qemu-xen-traditional.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog