-----BEGIN PGP SIGNATURE-----

iQIcBAABAgAGBQJauc7zAAoJEH3vgQaq/DkO1H4QAJ4TdeDt8l4+clbqeOa02xUu
 1pMoI7SshWqmXLJiHC217ZPwae3yF8nq5r+540JYK05uvZBAa2TyiogMWj5JCV7X
 IGKNDxWA7szka99bDYlr05RRG6Aom0jXAj0GhOAje8PNw+Z1n+XjiN5AwPzc7cNx
 aJ/u4N/447WTOdLSQyqupE0NqO3y1F/NdBLjJgGkJev/Ie+37oT7GPrJ2evf30pP
 MrfUBYND1EvwfHPOns/6eLtYSBLUEVrshr7H9fjjSrObSBzhfEwHegrakRgPbDG9
 3Sv5kSsXqjMC/ouWT5x4ttKCvhaVh23rwGXrt7jx4JFmeD5ZOCmL4mxr9BgPJ/IG
 FKfRYTmIyN7149tGS5sMsGt1/x6daPpcoZNpVO2laYgvvc7cshl4pS0m5EjVg2W5
 xBTmrWmVXJxtjG+RuG5vDlzOZ1CCkjty/+mDMskeZB7OwK41K0e0oLdM9IqQmJdJ
 dXoGSXZwnDyD76R8uJIghIAamiLxDZbZ8GqYoxHezA+at0oV6iTtYXK6JG/7+1fe
 A3KyeNGjrRrnexyiuXTsMyvTYnCI0D++exr3Ah4p1yoU71vUmRMfrhGJwJMPSSSb
 3r73JqilVV5bVjxzBhnZcEAKqlCLq5SAtYbDluqrgLcX1iVm6QgBEBe45TtX9fe5
 Y7rNlaJAODp8dZFWaTAe
 =J4ky
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Tue 27 Mar 2018 05:56:19 BST
# gpg:                using RSA key 7DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  macio: fix NULL pointer dereference when issuing IDE trim
  ide: fix invalid TRIM range abortion for macio

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/ide/core.c

@@ -402,7 +402,6 @@ typedef struct TrimAIOCB {
     QEMUIOVector *qiov;
     BlockAIOCB *aiocb;
     int i, j;
-    bool is_invalid;
 } TrimAIOCB;
 
 static void trim_aio_cancel(BlockAIOCB *acb)
@@ -430,11 +429,8 @@ static void ide_trim_bh_cb(void *opaque)
 {
     TrimAIOCB *iocb = opaque;
 
-    if (iocb->is_invalid) {
-        ide_dma_error(iocb->s);
-    } else {
-        iocb->common.cb(iocb->common.opaque, iocb->ret);
-    }
+    iocb->common.cb(iocb->common.opaque, iocb->ret);
+
     qemu_bh_delete(iocb->bh);
     iocb->bh = NULL;
     qemu_aio_unref(iocb);
@@ -462,7 +458,7 @@ static void ide_issue_trim_cb(void *opaque, int ret)
                 }
 
                 if (!ide_sect_range_ok(s, sector, count)) {
-                    iocb->is_invalid = true;
+                    iocb->ret = -EINVAL;
                     goto done;
                 }
 
@@ -502,7 +498,6 @@ BlockAIOCB *ide_issue_trim(
     iocb->qiov = qiov;
     iocb->i = -1;
     iocb->j = 0;
-    iocb->is_invalid = false;
     ide_issue_trim_cb(iocb, 0);
     return &iocb->common;
 }
@@ -848,6 +843,12 @@ static void ide_dma_cb(void *opaque, int ret)
     if (ret == -ECANCELED) {
         return;
     }
+
+    if (ret == -EINVAL) {
+        ide_dma_error(s);
+        return;
+    }
+
     if (ret < 0) {
         if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
             s->bus->dma->aiocb = NULL;

hw/ide/macio.c

@@ -187,7 +187,7 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
         break;
     case IDE_DMA_TRIM:
         s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk), &s->sg,
-                                        offset, 0x1, ide_issue_trim, s->blk,
+                                        offset, 0x1, ide_issue_trim, s,
                                         pmac_ide_transfer_cb, io,
                                         DMA_DIRECTION_TO_DEVICE);
         break;