[Qemu-devel] [PATCH] iscsi: fix race between task completition and task abortion

[Stefan Priebe]

From: spriebe <address@hidden>

---
 block/iscsi.c |   36 ++++++++++++++++++++----------------
 1 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c
index 12ca76d..257f97f 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -76,6 +76,10 @@ static void
 iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void 
*command_data,
                     void *private_data)
 {
+           IscsiAIOCB *acb = (IscsiAIOCB *)private_data;
+
+           scsi_free_scsi_task(acb->task);
+           acb->task = NULL;
 }
 
 static void
@@ -85,14 +89,19 @@ iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
     IscsiLun *iscsilun = acb->iscsilun;
 
     acb->common.cb(acb->common.opaque, -ECANCELED);
-    acb->canceled = 1;
 
-    /* send a task mgmt call to the target to cancel the task on the target */
-    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
-                                     iscsi_abort_task_cb, NULL);
+    if (acb->canceled != 0)
+        return;
+
+    acb->canceled = 1;
 
-    /* then also cancel the task locally in libiscsi */
-    iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task);
+    /* send a task mgmt call to the target to cancel the task on the target
+     * this also cancels the task in libiscsi
+     */
+    if (acb->task) {
+        iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
+                                         iscsi_abort_task_cb, &acb);
+    }
 }
 
 static AIOPool iscsi_aio_pool = {
@@ -184,6 +193,11 @@ iscsi_readv_writev_bh_cb(void *p)
     }
 
     qemu_aio_release(acb);
+
+    if (acb->task) {
+      scsi_free_scsi_task(acb->task);
+      acb->task = NULL;
+    }
 }
 
 
@@ -212,8 +226,6 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int 
status,
     }
 
     iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
 }
 
 static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
@@ -313,8 +325,6 @@ iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,
     }
 
     iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
 }
 
 static BlockDriverAIOCB *
@@ -429,8 +439,6 @@ iscsi_synccache10_cb(struct iscsi_context *iscsi, int 
status,
     }
 
     iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
 }
 
 static BlockDriverAIOCB *
@@ -483,8 +491,6 @@ iscsi_unmap_cb(struct iscsi_context *iscsi, int status,
     }
 
     iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
 }
 
 static BlockDriverAIOCB *
@@ -560,8 +566,6 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
     }
 
     iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
 }
 
 static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
-- 
1.7.2.5