lsi53c895a: keep SCSIRequest alive during DMA
Reentrant MMIO can cause the SCSIRequest to be completed, at which point lsi_request_orphan would drop the last reference. Anything that happens afterwards would access freed data. Keep a reference to the SCSIRequest and, through req->hba_private, to the lsi_request* for as long as DMA runs. Reported-by: Jihe Wang <wangjihe.mail@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Mar 27, 2026 at 18:42 UTC
d459131ff590c517bc89fa5867d4878b5eacbc30
1 file changed
+6
-1
hw/scsi/lsi53c895a.c
+6
-1
@@ -637,7 +637,7 @@ static void lsi_do_dma(LSIState *s, int out)
637
}
638
639
p = s->current;
640
- req = s->current->req;
640
+ req = scsi_req_ref(s->current->req);
641
dev = req->dev;
642
assert(dev);
643
@@ -667,6 +667,11 @@ static void lsi_do_dma(LSIState *s, int out)
667
} else {
668
lsi_mem_write(s, addr, p->dma_buf, count);
669
}
670
+ if (p->orphan) {
671
+ scsi_req_unref(req);
672
+ return;
673
+ }
674
+ scsi_req_unref(req);
675
676
p->dma_len -= count;
677
if (p->dma_len == 0) {