Once the I/O completion callback returned, aiocb will be released by the
controller. So we have to clear the reference not only in
scsi_write_complete, but also in scsi_read_complete. Otherwise we risk
inconsistencies when a reset hits us before the related request is
released.
Signed-off-by: Jan Kiszka <jan.kis...@siemens.com>
---
hw/scsi-disk.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index b8d805f..4d20919 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -125,6 +125,8 @@ static void scsi_read_complete(void * opaque, int ret)
{
SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+ r->req.aiocb = NULL;
+
if (ret) {
DPRINTF("IO error\n");
r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, 0);
--
1.6.0.2
