libFuzzer found a case where requests are queued for later in the AIO context, but a command set the bus inactive, then when finally the requests are processed by the DMA it aborts because it is inactive:
include/hw/ide/pci.h:59: IDEState *bmdma_active_if(BMDMAState *): Assertion `bmdma->bus->retry_unit != (uint8_t)-1' failed. Reproducer available on the BugLink. Fix by draining the pending DMA requests before inactivating the bus. BugLink: https://bugs.launchpad.net/qemu/+bug/1887303 Signed-off-by: Philippe Mathieu-Daudé <f4...@amsat.org> --- RFC because I don't have much clue about block drive and IDE, so block-team please be very careful while reviewing this bug. --- hw/ide/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/ide/core.c b/hw/ide/core.c index d997a78e47..f7affafb0c 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -804,7 +804,7 @@ void dma_buf_commit(IDEState *s, uint32_t tx_bytes) void ide_set_inactive(IDEState *s, bool more) { - s->bus->dma->aiocb = NULL; + ide_cancel_dma_sync(s); ide_clear_retry(s); if (s->bus->dma->ops->set_inactive) { s->bus->dma->ops->set_inactive(s->bus->dma, more); -- 2.21.3
