diff mbox series

[4/6] usb-storage: fill csw on cancel

Message ID 20201105134112.25119-5-kraxel@redhat.com
State Accepted
Commit af06a0265e31848d895c1bbe173f03607cdba532
Headers show
Series usb: fix some guest-triggerable asserts | expand

Commit Message

Gerd Hoffmann Nov. 5, 2020, 1:41 p.m. UTC 
When scsi requests are canceled fill the csw
(command status word) accordingly.

Buglink: https://bugs.launchpad.net/qemu/+bug/1901981
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/dev-storage.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 360e8ca8f2bd..f0f005869d25 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -327,6 +327,10 @@  static void usb_msd_request_cancelled(SCSIRequest *req)
     trace_usb_msd_cmd_cancel(req->tag);
 
     if (req == s->req) {
+        s->csw.sig = cpu_to_le32(0x53425355);
+        s->csw.tag = cpu_to_le32(req->tag);
+        s->csw.status = 1; /* error */
+
         scsi_req_unref(s->req);
         s->req = NULL;
         s->scsi_len = 0;