The .reply_possible field of s->requests is never set to false. This is not a big problem as it is only a safeguard to detect protocol errors, but fix it anyway.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/block/nbd.c b/block/nbd.c index 567872ac53..6a5e410e5f 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -454,15 +454,16 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle) nbd_channel_error(s, -EINVAL); return -EINVAL; } - if (s->reply.handle == handle) { - /* We are done */ - return 0; - } ind2 = HANDLE_TO_INDEX(s, s->reply.handle); if (ind2 >= MAX_NBD_REQUESTS || !s->requests[ind2].reply_possible) { nbd_channel_error(s, -EINVAL); return -EINVAL; } + s->requests[ind2].reply_possible = nbd_reply_is_structured(&s->reply); + if (s->reply.handle == handle) { + /* We are done */ + return 0; + } nbd_recv_coroutine_wake_one(&s->requests[ind2]); } } -- 2.35.1