* [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests
@ 2016-05-24 8:07 P J P
2016-06-07 6:42 ` P J P
0 siblings, 1 reply; 4+ messages in thread
From: P J P @ 2016-05-24 8:07 UTC (permalink / raw)
To: Qemu Developers
Cc: Paolo Bonzini, Hannes Reinecke, Alexander Graf, Li Qiang,
Prasad J Pandit
From: Prasad J Pandit <pjp@fedoraproject.org>
The LSI SAS1068 Host Bus Adapter emulator in Qemu, periodically
looks for requests and fetches them. A loop doing that in
mptsas_fetch_requests() could run infinitely if 's->state' was
not operational. Move check to avoid such a loop.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/scsi/mptsas.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index 499c146..be88e16 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -754,11 +754,6 @@ static void mptsas_fetch_request(MPTSASState *s)
hwaddr addr;
int size;
- if (s->state != MPI_IOC_STATE_OPERATIONAL) {
- mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
- return;
- }
-
/* Read the message header from the guest first. */
addr = s->host_mfa_high_addr | MPTSAS_FIFO_GET(s, request_post);
pci_dma_read(pci, addr, req, sizeof(hdr));
@@ -789,6 +784,10 @@ static void mptsas_fetch_requests(void *opaque)
{
MPTSASState *s = opaque;
+ if (s->state != MPI_IOC_STATE_OPERATIONAL) {
+ mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
+ return;
+ }
while (!MPTSAS_FIFO_EMPTY(s, request_post)) {
mptsas_fetch_request(s);
}
--
2.5.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests
2016-05-24 8:07 [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests P J P
@ 2016-06-07 6:42 ` P J P
2016-06-07 7:53 ` Paolo Bonzini
0 siblings, 1 reply; 4+ messages in thread
From: P J P @ 2016-06-07 6:42 UTC (permalink / raw)
To: Qemu Developers; +Cc: Paolo Bonzini, Li Qiang, Hannes Reinecke, Alexander Graf
+-- On Tue, 24 May 2016, P J P wrote --+
| diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
| index 499c146..be88e16 100644
| --- a/hw/scsi/mptsas.c
| +++ b/hw/scsi/mptsas.c
| @@ -754,11 +754,6 @@ static void mptsas_fetch_request(MPTSASState *s)
| hwaddr addr;
| int size;
|
| - if (s->state != MPI_IOC_STATE_OPERATIONAL) {
| - mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
| - return;
| - }
| -
| /* Read the message header from the guest first. */
| addr = s->host_mfa_high_addr | MPTSAS_FIFO_GET(s, request_post);
| pci_dma_read(pci, addr, req, sizeof(hdr));
| @@ -789,6 +784,10 @@ static void mptsas_fetch_requests(void *opaque)
| {
| MPTSASState *s = opaque;
|
| + if (s->state != MPI_IOC_STATE_OPERATIONAL) {
| + mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
| + return;
| + }
| while (!MPTSAS_FIFO_EMPTY(s, request_post)) {
| mptsas_fetch_request(s);
| }
Ping..!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests
2016-06-07 6:42 ` P J P
@ 2016-06-07 7:53 ` Paolo Bonzini
2016-06-07 8:44 ` P J P
0 siblings, 1 reply; 4+ messages in thread
From: Paolo Bonzini @ 2016-06-07 7:53 UTC (permalink / raw)
To: P J P, Qemu Developers; +Cc: Li Qiang, Hannes Reinecke, Alexander Graf
On 07/06/2016 08:42, P J P wrote:
> +-- On Tue, 24 May 2016, P J P wrote --+
> | diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
> | index 499c146..be88e16 100644
> | --- a/hw/scsi/mptsas.c
> | +++ b/hw/scsi/mptsas.c
> | @@ -754,11 +754,6 @@ static void mptsas_fetch_request(MPTSASState *s)
> | hwaddr addr;
> | int size;
> |
> | - if (s->state != MPI_IOC_STATE_OPERATIONAL) {
> | - mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
> | - return;
> | - }
> | -
> | /* Read the message header from the guest first. */
> | addr = s->host_mfa_high_addr | MPTSAS_FIFO_GET(s, request_post);
> | pci_dma_read(pci, addr, req, sizeof(hdr));
> | @@ -789,6 +784,10 @@ static void mptsas_fetch_requests(void *opaque)
> | {
> | MPTSASState *s = opaque;
> |
> | + if (s->state != MPI_IOC_STATE_OPERATIONAL) {
> | + mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
> | + return;
> | + }
> | while (!MPTSAS_FIFO_EMPTY(s, request_post)) {
> | mptsas_fetch_request(s);
> | }
>
> Ping..!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
>
>
This is commit 06630554ccbdd25780aa03c3548aaff1eb56dffd.
Paolo
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests
2016-06-07 7:53 ` Paolo Bonzini
@ 2016-06-07 8:44 ` P J P
0 siblings, 0 replies; 4+ messages in thread
From: P J P @ 2016-06-07 8:44 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Qemu Developers, Li Qiang, Hannes Reinecke, Alexander Graf
+-- On Tue, 7 Jun 2016, Paolo Bonzini wrote --+
| > | + if (s->state != MPI_IOC_STATE_OPERATIONAL) {
| > | + mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
| > | + return;
| > | + }
| > | while (!MPTSAS_FIFO_EMPTY(s, request_post)) {
| > | mptsas_fetch_request(s);
| > | }
|
| This is commit 06630554ccbdd25780aa03c3548aaff1eb56dffd.
Okay, thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-07 8:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-24 8:07 [Qemu-devel] [PATCH] scsi: mptsas: infinite loop while fetching requests P J P
2016-06-07 6:42 ` P J P
2016-06-07 7:53 ` Paolo Bonzini
2016-06-07 8:44 ` P J P
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).