From: Klaus Jensen Date: Mon, 22 Mar 2021 06:10:24 +0000 (+0100) Subject: hw/block/nvme: fix ref counting in nvme_format_ns X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=3a69cadbef7af23a566dbe2400043c247c3d50ca;p=qmiga%2Fqemu.git hw/block/nvme: fix ref counting in nvme_format_ns Max noticed that since blk_aio_pwrite_zeroes() may invoke the callback before returning, the callbacks will never see *count == 0 and thus never free the count variable or decrement num_formats causing a CQE to never be posted. Coverity (CID 1451082) also picked up on the fact that count would not be free'ed if the namespace was of zero size. Fix both of these issues by explicitly checking *count and finalize for the given namespace if --(*count) is zero. Enqueing a CQE if there are no AIOs outstanding after this case is already handled by nvme_format() by inspecting *num_formats. Reported-by: Max Reitz Reported-by: Coverity (CID 1451082) Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Signed-off-by: Klaus Jensen Reviewed-by: Gollu Appalanaidu --- diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 6842b01ab5..c54ec3c952 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -5009,9 +5009,15 @@ static uint16_t nvme_format_ns(NvmeCtrl *n, NvmeNamespace *ns, uint8_t lbaf, } - (*count)--; + if (--(*count)) { + return NVME_NO_COMPLETE; + } - return NVME_NO_COMPLETE; + g_free(count); + ns->status = 0x0; + (*num_formats)--; + + return NVME_SUCCESS; } static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)