aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2010-05-04 16:35:24 +0200
committerDoug Goldstein <cardoe@gentoo.org>2010-07-20 17:33:37 -0500
commita7d6cd140ca211e2964e97fa12712ee03a6c526b (patch)
treed070e15b1c2bdb94d07f72b7cb056976fd11ef93
parentusb-bus: fix no params (diff)
downloadqemu-kvm-a7d6cd140ca211e2964e97fa12712ee03a6c526b.tar.gz
qemu-kvm-a7d6cd140ca211e2964e97fa12712ee03a6c526b.tar.bz2
qemu-kvm-a7d6cd140ca211e2964e97fa12712ee03a6c526b.zip
ide: Fix ide_dma_cancel
When cancelling a request, bdrv_aio_cancel may decide that it waits for completion of a request rather than for cancellation. IDE therefore can't abandon its DMA status before calling bdrv_aio_cancel; otherwise the callback of a completed request would use invalid data. Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 38d8dfa193e9a45f0f08b06aab2ba2a94f40a041)
-rw-r--r--hw/ide/core.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 64aebc276..f9bb33877 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -2827,10 +2827,6 @@ static void ide_dma_restart(IDEState *s, int is_read)
void ide_dma_cancel(BMDMAState *bm)
{
if (bm->status & BM_STATUS_DMAING) {
- bm->status &= ~BM_STATUS_DMAING;
- /* cancel DMA request */
- bm->unit = -1;
- bm->dma_cb = NULL;
if (bm->aiocb) {
#ifdef DEBUG_AIO
printf("aio_cancel\n");
@@ -2838,6 +2834,10 @@ void ide_dma_cancel(BMDMAState *bm)
bdrv_aio_cancel(bm->aiocb);
bm->aiocb = NULL;
}
+ bm->status &= ~BM_STATUS_DMAING;
+ /* cancel DMA request */
+ bm->unit = -1;
+ bm->dma_cb = NULL;
}
}