Merge commit 'v0.12.4' into stable-0.12qemu-kvm-0.12.4

* commit 'v0.12.4': (49 commits)
  Update for 0.12.4 release
  Workaround for broken OSS_GETVERSION on FreeBSD, part two
  oss: fix fragment setting
  oss: issue OSS_GETVERSION ioctl only when needed
  oss: refactor code around policy setting
  oss: workaround for cases when OSS_GETVERSION is not defined
  block: Free iovec arrays allocated by multiwrite_merge()
  lsi: fix segfault in lsi_command_complete
  lsi: pass lsi_request to lsi_reselect
  lsi: move dma_len+dma_buf into lsi_request
  lsi: move current_dev into lsi_request
  lsi: have lsi_request for the whole life time of the request.
  lsi: use QTAILQ for lsi_queue
  tcp/mips: Change TCG_AREG0 (fp -> s0)
  sh_pci: fix memory and I/O access
  Fix incoming migration with iothread
  Fix SIGFPE for vnc display of width/height = 1
  net: remove broken net_set_boot_mask() boot device validation
  qcow2: Remove request from in-flight list after error
  qcow2: Don't ignore immediate read/write failures
  ...

Signed-off-by: Avi Kivity <avi@redhat.com>

1 files changed, 11 insertions, 3 deletions

diff --git a/block.c b/block.c
index 97af3f577..7326bfeee 100644
--- a/block.c
+++ b/block.c
@@ -1608,6 +1608,9 @@ static void multiwrite_user_cb(MultiwriteCB *mcb)
 
     for (i = 0; i < mcb->num_callbacks; i++) {
         mcb->callbacks[i].cb(mcb->callbacks[i].opaque, mcb->error);
+        if (mcb->callbacks[i].free_qiov) {
+            qemu_iovec_destroy(mcb->callbacks[i].free_qiov);
+        }
         qemu_free(mcb->callbacks[i].free_qiov);
         qemu_vfree(mcb->callbacks[i].free_buf);
     }
@@ -1617,7 +1620,7 @@ static void multiwrite_cb(void *opaque, int ret)
 {
     MultiwriteCB *mcb = opaque;
 
-    if (ret < 0) {
+    if (ret < 0 && !mcb->error) {
         mcb->error = ret;
         multiwrite_user_cb(mcb);
     }
@@ -1669,6 +1672,10 @@ static int multiwrite_merge(BlockDriverState *bs, BlockRequest *reqs,
             merge = bs->drv->bdrv_merge_requests(bs, &reqs[outidx], &reqs[i]);
         }
 
+        if (reqs[outidx].qiov->niov + reqs[i].qiov->niov + 1 > IOV_MAX) {
+            merge = 0;
+        }
+
         if (merge) {
             size_t size;
             QEMUIOVector *qiov = qemu_mallocz(sizeof(*qiov));
@@ -1754,10 +1761,11 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
             // submitted yet. Otherwise we'll wait for the submitted AIOs to
             // complete and report the error in the callback.
             if (mcb->num_requests == 0) {
-                reqs[i].error = EIO;
+                reqs[i].error = -EIO;
                 goto fail;
             } else {
-                mcb->error = EIO;
+                mcb->num_requests++;
+                multiwrite_cb(mcb, -EIO);
                 break;
             }
         } else {