Commit 1d5e53df16 for qemu.org

commit 1d5e53df1674e0e45be50a4a873e6deede2eecd7
Author: Minwoo Im <minwoo.im.dev@gmail.com>
Date:   Wed Jul 29 19:34:52 2026 +0900

    hw/nvme: drop AER requests without aiocb in nvme_del_sq()

    nvme_del_sq() asserted r->aiocb was always set when canceling a
    queue's inflight requests. A pending Async Event Request has no
    aiocb (nvme_aer() parks it without issuing any block I/O), so
    deleting a queue with an outstanding AER trips the assert instead of
    just dropping the request.

    Cc: qemu-stable@nongnu.org
    Signed-off-by: Minwoo Im <minwoo.im@samsung.com>
    Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index bd6ad64b20..e3eadf3d1d 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -4862,12 +4862,14 @@ static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest *req)
     sq = n->sq[qid];
     while (!QTAILQ_EMPTY(&sq->out_req_list)) {
         r = QTAILQ_FIRST(&sq->out_req_list);
-        assert(r->aiocb);
         r->status = NVME_CMD_ABORT_SQ_DEL;
-        blk_aio_cancel(r->aiocb);
-    }

-    assert(QTAILQ_EMPTY(&sq->out_req_list));
+        if (r->aiocb) {
+            blk_aio_cancel(r->aiocb);
+        } else {
+            QTAILQ_REMOVE(&sq->out_req_list, r, entry);
+        }
+    }

     if (!nvme_check_cqid(n, sq->cqid)) {
         cq = n->cq[sq->cqid];