Since there is no return after nvme_dsm_cb invocation, metadata
associated with non-zero block range is currently zeroed. Also this
behaviour leads to segfault since we schedule iocb->bh two times.
First when entering nvme_dsm_cb with iocb->idx == iocb->nr and
second because of missing return on call stack unwinding by calling
blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback.

Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")
Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
---
v2:
- Instead of adding else just insert return statement
- Add: "Fixes: d7d1474fd85d" to commit message

 hw/nvme/ctrl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 03760ddeae..74540a03d5 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -2372,6 +2372,7 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
         }
 
         nvme_dsm_cb(iocb, 0);
+        return;
     }
 
     iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
-- 
2.35.1

On Apr 15 23:48, Dmitry Tikhov wrote:
> Since there is no return after nvme_dsm_cb invocation, metadata
> associated with non-zero block range is currently zeroed. Also this
> behaviour leads to segfault since we schedule iocb->bh two times.
> First when entering nvme_dsm_cb with iocb->idx == iocb->nr and
> second because of missing return on call stack unwinding by calling
> blk_aio_pwrite_zeroes and subsequent nvme_dsm_cb callback.
> 
> Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")
> Signed-off-by: Dmitry Tikhov <d.tihov@yadro.com>
> ---
> v2:
> - Instead of adding else just insert return statement
> - Add: "Fixes: d7d1474fd85d" to commit message
> 
>  hw/nvme/ctrl.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> index 03760ddeae..74540a03d5 100644
> --- a/hw/nvme/ctrl.c
> +++ b/hw/nvme/ctrl.c
> @@ -2372,6 +2372,7 @@ static void nvme_dsm_md_cb(void *opaque, int ret)
>          }
>  
>          nvme_dsm_cb(iocb, 0);
> +        return;
>      }
>  
>      iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
> -- 
> 2.35.1
> 

Thanks,

Applied to nvme-next!