Merge lp:~serge-hallyn/ubuntu/lucid/qemu-kvm/fix-scsi-writeback into lp:ubuntu/lucid/qemu-kvm

[Serge Hallyn]

This is a fix for LP #595438

[Thierry Carrez (ttx)]

Looks good, however before this can be committed there should be an SRU report on bug 595438. This allows the SRU team to assess impact vs. regression risk, and give a testcase for the lucid-proposed testers. See https://wiki.ubuntu.com/StableReleaseUpdates#Procedure for details...

[Thierry Carrez (ttx)]

Version should be "0.12.3+noroms-0ubuntu9.3" and target pocket "lucid-proposed". I'll make the corresponding changes and upload.

review: Approve

[Thierry Carrez (ttx)]

Hmm, cannot chnage status to "Merged", probably because it should have been proposed for merging into lucid-proposed and not "lucid".

[Thierry Carrez (ttx)]

Uploaded to lucid-proposed

=== modified file 'debian/changelog'
--- debian/changelog	2010-04-23 18:45:55 +0000
+++ debian/changelog	2010-08-07 17:51:48 +0000
@@ -1,3 +1,9 @@
+qemu-kvm (0.12.3+noroms-0ubuntu10) lucid; urgency=low
+
+  * Fix segfault when using scsi with writeback (LP: #595438)
+
+ -- Serge Hallyn <[e-mail]>  Wed, 28 Jul 2010 09:56:56 -0500
+
 qemu-kvm (0.12.3+noroms-0ubuntu9) lucid; urgency=low
 
   * Architecture-specific fixes (LP: #568904)
 
=== added file 'debian/patches/scsi-Dequeue-requests-before-invoking-completion-callback.patch'
--- debian/patches/scsi-Dequeue-requests-before-invoking-completion-callback.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/scsi-Dequeue-requests-before-invoking-completion-callback.patch	2010-08-07 17:51:48 +0000
@@ -0,0 +1,71 @@
+commit e8637c9013609271772cc0c3436cb1240cd6b034
+Author: Jan Kiszka <[e-mail]>
+Date:   Tue Jul 13 14:13:45 2010 +0200
+
+    scsi: Dequeue requests before invoking completion callback
+    
+    The request completion callback of the LSI controller may start the next
+    request that can use the same tag as the completed one. As the latter is
+    still enqueued at that point, scsi_send_command will complain about the
+    tag reuse and cancel the completed request. That will cause a double
+    free later on when the completion path cleans up as well.
+    
+    Fix this by dequeuing the request before invoking the callback.
+    
+    Signed-off-by: Jan Kiszka <[e-mail]>
+    Signed-off-by: Aurelien Jarno <[e-mail]>
+
+Origin: upstream, http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=e8637c9013609271772cc0c3436cb1240cd6b034
+Bug-ubuntu: https://bugs.launchpad.net/qemu-kvm/+bug/595438
+
+Index: fix-scsi/hw/scsi-bus.c
+===================================================================
+--- fix-scsi.orig/hw/scsi-bus.c	2010-07-28 09:49:02.000000000 -0500
++++ fix-scsi/hw/scsi-bus.c	2010-07-28 09:55:42.222916455 -0500
+@@ -133,6 +133,7 @@
+     req->tag = tag;
+     req->lun = lun;
+     req->status = -1;
++    req->enqueued = true;
+     QTAILQ_INSERT_TAIL(&d->requests, req, next);
+     return req;
+ }
+@@ -149,9 +150,17 @@
+     return NULL;
+ }
+ 
++static void scsi_req_dequeue(SCSIRequest *req)
++{
++    if (req->enqueued) {
++        QTAILQ_REMOVE(&req->dev->requests, req, next);
++        req->enqueued = false;
++    }
++}
++
+ void scsi_req_free(SCSIRequest *req)
+ {
+-    QTAILQ_REMOVE(&req->dev->requests, req, next);
++    scsi_req_dequeue(req);
+     qemu_free(req);
+ }
+ 
+@@ -492,6 +501,7 @@
+ void scsi_req_complete(SCSIRequest *req)
+ {
+     assert(req->status != -1);
++    scsi_req_dequeue(req);
+     req->bus->complete(req->bus, SCSI_REASON_DONE,
+                        req->tag,
+                        req->status);
+Index: fix-scsi/hw/scsi.h
+===================================================================
+--- fix-scsi.orig/hw/scsi.h	2010-07-28 09:49:02.000000000 -0500
++++ fix-scsi/hw/scsi.h	2010-07-28 09:55:42.222916455 -0500
+@@ -42,6 +42,7 @@
+         enum SCSIXferMode mode;
+     } cmd;
+     BlockDriverAIOCB  *aiocb;
++    bool enqueued;
+     QTAILQ_ENTRY(SCSIRequest) next;
+ } SCSIRequest;
+ 
 
=== modified file 'debian/patches/series'
--- debian/patches/series	2010-04-01 00:22:02 +0000
+++ debian/patches/series	2010-08-07 17:51:48 +0000
@@ -9,3 +9,4 @@
 arm-higher-initrd-load-address.patch
 larger_default_ram_size.patch
 SDL-wrong-behaviour-of-caps-lock.patch
+scsi-Dequeue-requests-before-invoking-completion-callback.patch