* [PATCH] esp: process the result of scsi_device_find()
@ 2023-12-18 15:02 Alexandra Diupina
2023-12-26 12:08 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 6+ messages in thread
From: Alexandra Diupina @ 2023-12-18 15:02 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Alexandra Diupina, Fam Zheng, qemu-devel, sdl.qemu
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
---
hw/scsi/esp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9b11d8c573..3a2ec35f9b 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
+
+ if (!current_lun) {
+ return;
+ }
+
s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
datalen = scsi_req_enqueue(s->current_req);
s->ti_size = datalen;
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] esp: process the result of scsi_device_find()
2023-12-18 15:02 [PATCH] esp: process the result of scsi_device_find() Alexandra Diupina
@ 2023-12-26 12:08 ` Philippe Mathieu-Daudé
2023-12-27 20:02 ` Mark Cave-Ayland
0 siblings, 1 reply; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2023-12-26 12:08 UTC (permalink / raw)
To: Alexandra Diupina, Paolo Bonzini, Mark Cave-Ayland
Cc: Fam Zheng, qemu-devel, sdl.qemu
Cc'ing Mark for the logical change (should we rather assert?).
On 18/12/23 16:02, Alexandra Diupina wrote:
> Add a 'current_lun' check for a null value
> to avoid null pointer dereferencing
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
> ---
> hw/scsi/esp.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index 9b11d8c573..3a2ec35f9b 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
> esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>
> current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
> +
> + if (!current_lun) {
> + return;
> + }
> +
> s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
> datalen = scsi_req_enqueue(s->current_req);
> s->ti_size = datalen;
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] esp: process the result of scsi_device_find()
2023-12-26 12:08 ` Philippe Mathieu-Daudé
@ 2023-12-27 20:02 ` Mark Cave-Ayland
2023-12-29 15:26 ` [PATCH v2] " Alexandra Diupina
0 siblings, 1 reply; 6+ messages in thread
From: Mark Cave-Ayland @ 2023-12-27 20:02 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, Alexandra Diupina, Paolo Bonzini
Cc: Fam Zheng, qemu-devel, sdl.qemu
On 26/12/2023 12:08, Philippe Mathieu-Daudé wrote:
> Cc'ing Mark for the logical change (should we rather assert?).
>
> On 18/12/23 16:02, Alexandra Diupina wrote:
>> Add a 'current_lun' check for a null value
>> to avoid null pointer dereferencing
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
>> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
>> ---
>> hw/scsi/esp.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
>> index 9b11d8c573..3a2ec35f9b 100644
>> --- a/hw/scsi/esp.c
>> +++ b/hw/scsi/esp.c
>> @@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
>> esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>> current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
>> +
>> + if (!current_lun) {
>> + return;
>> + }
>> +
>> s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
>> datalen = scsi_req_enqueue(s->current_req);
>> s->ti_size = datalen;
Checking for the NULL return from scsi_device_find() looks correct to me, but I don't
think that a simple return will allow the host to recover. I suspect the right thing
to do here is to duplicate the scsi_device_find() logic just above i.e. set the
INTR_DC bit and then raise the IRQ if NULL is returned.
ATB,
Mark.
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v2] esp: process the result of scsi_device_find()
2023-12-27 20:02 ` Mark Cave-Ayland
@ 2023-12-29 15:26 ` Alexandra Diupina
2023-12-29 17:51 ` Philippe Mathieu-Daudé
2023-12-30 9:32 ` Paolo Bonzini
0 siblings, 2 replies; 6+ messages in thread
From: Alexandra Diupina @ 2023-12-29 15:26 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Alexandra Diupina, Fam Zheng, qemu-devel, sdl.qemu
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing and
recover host if NULL return
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
---
v2: duplicate the scsi_device_find() logic from esp_select()
hw/scsi/esp.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9b11d8c573..03fdd53de6 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -292,6 +292,16 @@ static void do_command_phase(ESPState *s)
esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
+
+ if (!current_lun) {
+ /* No such drive */
+ s->rregs[ESP_RSTAT] = 0;
+ s->rregs[ESP_RINTR] = INTR_DC;
+ s->rregs[ESP_RSEQ] = SEQ_0;
+ esp_raise_irq(s);
+ return;
+ }
+
s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
datalen = scsi_req_enqueue(s->current_req);
s->ti_size = datalen;
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] esp: process the result of scsi_device_find()
2023-12-29 15:26 ` [PATCH v2] " Alexandra Diupina
@ 2023-12-29 17:51 ` Philippe Mathieu-Daudé
2023-12-30 9:32 ` Paolo Bonzini
1 sibling, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2023-12-29 17:51 UTC (permalink / raw)
To: Alexandra Diupina, Paolo Bonzini
Cc: Fam Zheng, qemu-devel, sdl.qemu, Mark Cave-Ayland
Cc'ing Mark.
On 29/12/23 16:26, Alexandra Diupina wrote:
> Add a 'current_lun' check for a null value
> to avoid null pointer dereferencing and
> recover host if NULL return
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
> ---
> v2: duplicate the scsi_device_find() logic from esp_select()
> hw/scsi/esp.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index 9b11d8c573..03fdd53de6 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -292,6 +292,16 @@ static void do_command_phase(ESPState *s)
> esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>
> current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
> +
> + if (!current_lun) {
> + /* No such drive */
> + s->rregs[ESP_RSTAT] = 0;
> + s->rregs[ESP_RINTR] = INTR_DC;
> + s->rregs[ESP_RSEQ] = SEQ_0;
> + esp_raise_irq(s);
> + return;
> + }
> +
> s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
> datalen = scsi_req_enqueue(s->current_req);
> s->ti_size = datalen;
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] esp: process the result of scsi_device_find()
2023-12-29 15:26 ` [PATCH v2] " Alexandra Diupina
2023-12-29 17:51 ` Philippe Mathieu-Daudé
@ 2023-12-30 9:32 ` Paolo Bonzini
1 sibling, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2023-12-30 9:32 UTC (permalink / raw)
To: Alexandra Diupina; +Cc: Fam Zheng, qemu-devel, sdl.qemu
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-12-30 9:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-18 15:02 [PATCH] esp: process the result of scsi_device_find() Alexandra Diupina
2023-12-26 12:08 ` Philippe Mathieu-Daudé
2023-12-27 20:02 ` Mark Cave-Ayland
2023-12-29 15:26 ` [PATCH v2] " Alexandra Diupina
2023-12-29 17:51 ` Philippe Mathieu-Daudé
2023-12-30 9:32 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).