scsi: do not call transfer_data after canceling a request

Otherwise, if cancellation is "faked" by the AIO layer and goes
through qemu_aio_flush, the whole request is completed synchronously
during scsi_req_cancel.

Using the enqueued flag would work here, but not in the next patches,
so I'm introducing a new io_canceled flag.  That's because scsi_req_data
is a synchronous callback and the enqueued flag might be reset by the
time it returns.  scsi-disk cannot unref the request until after calling
scsi_req_data.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/hw/scsi.h b/hw/scsi.h
index 8ea744a392..fcc345581d 100644
--- a/hw/scsi.h
+++ b/hw/scsi.h
@@ -51,6 +51,7 @@ struct SCSIRequest {
     uint8_t sense[SCSI_SENSE_BUF_SIZE];
     uint32_t sense_len;
     bool enqueued;
+    bool io_canceled;
     void *hba_private;
     QTAILQ_ENTRY(SCSIRequest) next;
 };