On migration, scsi does not check for NULL from load_request, and just does a NULL deref if that fails.
spapr_vscsi already returns NULL on failure, and follow up patches will add more. Fail migration gracefully instead. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3888 Signed-off-by: Michael S. Tsirkin <[email protected]> --- hw/scsi/scsi-bus.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c index deb43d5560..fa7ac415e4 100644 --- a/hw/scsi/scsi-bus.c +++ b/hw/scsi/scsi-bus.c @@ -1922,6 +1922,10 @@ static int get_scsi_requests(QEMUFile *f, void *pv, size_t size, req->retry = (sbyte == 1); if (bus->info->load_request) { req->hba_private = bus->info->load_request(f, req); + if (!req->hba_private && qemu_file_get_error(f)) { + scsi_req_unref(req); + return -1; + } } if (req->ops->load_request) { req->ops->load_request(f, req); -- MST
