* [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write
@ 2017-04-24 12:06 P J P
2017-04-28 8:35 ` P J P
0 siblings, 1 reply; 4+ messages in thread
From: P J P @ 2017-04-24 12:06 UTC (permalink / raw)
To: Qemu Developers; +Cc: YY Z, Paolo Bonzini, Prasad J Pandit
From: Prasad J Pandit <pjp@fedoraproject.org>
While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
an off-by-one error could occur as 's->adp_reset' index is not
reset after reading the last sequence.
Reported-by: YY Z <bigbird475958471@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/scsi/megasas.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 84b8caf..804122a 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
case MFI_SEQ:
trace_megasas_mmio_writel("MFI_SEQ", val);
/* Magic sequence to start ADP reset */
- if (adp_reset_seq[s->adp_reset] == val) {
- s->adp_reset++;
+ if (adp_reset_seq[s->adp_reset++] == val) {
+ if (s->adp_reset == 6) {
+ s->adp_reset = 0;
+ s->diag = MFI_DIAG_WRITE_ENABLE;
+ }
} else {
s->adp_reset = 0;
s->diag = 0;
}
- if (s->adp_reset == 6) {
- s->diag = MFI_DIAG_WRITE_ENABLE;
- }
break;
case MFI_DIAG:
trace_megasas_mmio_writel("MFI_DIAG", val);
--
2.9.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write
2017-04-24 12:06 [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write P J P
@ 2017-04-28 8:35 ` P J P
2017-04-28 9:54 ` Paolo Bonzini
0 siblings, 1 reply; 4+ messages in thread
From: P J P @ 2017-04-28 8:35 UTC (permalink / raw)
To: Qemu Developers; +Cc: Paolo Bonzini, YY Z
+-- On Mon, 24 Apr 2017, P J P wrote --+
| While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
| an off-by-one error could occur as 's->adp_reset' index is not
| reset after reading the last sequence.
|
| --- a/hw/scsi/megasas.c
| +++ b/hw/scsi/megasas.c
| @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
| case MFI_SEQ:
| trace_megasas_mmio_writel("MFI_SEQ", val);
| /* Magic sequence to start ADP reset */
| - if (adp_reset_seq[s->adp_reset] == val) {
| - s->adp_reset++;
| + if (adp_reset_seq[s->adp_reset++] == val) {
| + if (s->adp_reset == 6) {
| + s->adp_reset = 0;
| + s->diag = MFI_DIAG_WRITE_ENABLE;
| + }
| } else {
| s->adp_reset = 0;
| s->diag = 0;
| }
| - if (s->adp_reset == 6) {
| - s->diag = MFI_DIAG_WRITE_ENABLE;
| - }
| break;
Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write
2017-04-28 8:35 ` P J P
@ 2017-04-28 9:54 ` Paolo Bonzini
2017-04-28 11:03 ` P J P
0 siblings, 1 reply; 4+ messages in thread
From: Paolo Bonzini @ 2017-04-28 9:54 UTC (permalink / raw)
To: P J P, Qemu Developers; +Cc: YY Z
On 28/04/2017 10:35, P J P wrote:
> +-- On Mon, 24 Apr 2017, P J P wrote --+
> | While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
> | an off-by-one error could occur as 's->adp_reset' index is not
> | reset after reading the last sequence.
> |
> | --- a/hw/scsi/megasas.c
> | +++ b/hw/scsi/megasas.c
> | @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
> | case MFI_SEQ:
> | trace_megasas_mmio_writel("MFI_SEQ", val);
> | /* Magic sequence to start ADP reset */
> | - if (adp_reset_seq[s->adp_reset] == val) {
> | - s->adp_reset++;
> | + if (adp_reset_seq[s->adp_reset++] == val) {
> | + if (s->adp_reset == 6) {
> | + s->adp_reset = 0;
> | + s->diag = MFI_DIAG_WRITE_ENABLE;
> | + }
> | } else {
> | s->adp_reset = 0;
> | s->diag = 0;
> | }
> | - if (s->adp_reset == 6) {
> | - s->diag = MFI_DIAG_WRITE_ENABLE;
> | - }
> | break;
>
> Ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
>
I've already queued this patch.
Paolo
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write
2017-04-28 9:54 ` Paolo Bonzini
@ 2017-04-28 11:03 ` P J P
0 siblings, 0 replies; 4+ messages in thread
From: P J P @ 2017-04-28 11:03 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Qemu Developers, YY Z
+-- On Fri, 28 Apr 2017, Paolo Bonzini wrote --+
| > | /* Magic sequence to start ADP reset */
| > | - if (adp_reset_seq[s->adp_reset] == val) {
| > | - s->adp_reset++;
| > | + if (adp_reset_seq[s->adp_reset++] == val) {
| > | + if (s->adp_reset == 6) {
| > | + s->adp_reset = 0;
| > | + s->diag = MFI_DIAG_WRITE_ENABLE;
| > | + }
| > | } else {
| > | s->adp_reset = 0;
| > | s->diag = 0;
| > | }
| > | - if (s->adp_reset == 6) {
| > | - s->diag = MFI_DIAG_WRITE_ENABLE;
| > | - }
| > | break;
|
| I've already queued this patch.
Oh, okay. Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-04-28 11:03 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-04-24 12:06 [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write P J P
2017-04-28 8:35 ` P J P
2017-04-28 9:54 ` Paolo Bonzini
2017-04-28 11:03 ` P J P
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).