Re: [PATCH] hw/scsi/esp: fix assertion error in fifo8_push

["Philippe Mathieu-Daudé" <philmd@linaro.org>]

Hi,

Cc'ing maintainers:

$ ./scripts/get_maintainer.pl -f hw/scsi/esp.c
Paolo Bonzini <pbonzini@redhat.com> (supporter:SCSI)
Fam Zheng <fam@euphon.net> (reviewer:SCSI)
$ ./scripts/get_maintainer.pl -f migration/
Peter Xu <peterx@redhat.com> (maintainer:Migration)
Fabiano Rosas <farosas@suse.de> (maintainer:Migration)

On 27/5/25 15:12, Zheng Huang wrote:
> This patch add validation checks on FIFO structures in esp_post_load() to
> avoid assertion error `assert(fifo->num < fifo->capacity);` in fifo8_push(),
> which can occur if the inbound migration stream is malformed. By performing
> these checks during post-load, we can catch and handle such issues earlier,
> avoiding crashes due to corrupted state.

How can that happen? Can you share a reproducer?

> 
> Signed-off-by: Zheng Huang <hz1624917200@gmail.com>
> ---
>   hw/scsi/esp.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index ac841dc32e..ba77017087 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -1350,11 +1350,17 @@ static int esp_post_load(void *opaque, int version_id)
>           /* Migrate ti_buf to fifo */
>           len = s->mig_ti_wptr - s->mig_ti_rptr;
>           for (i = 0; i < len; i++) {
> +            if (&s->fifo.num >= &s->fifo.capacity) {
> +                return -1;
> +            }
>               fifo8_push(&s->fifo, s->mig_ti_buf[i]);
>           }
>   
>           /* Migrate cmdbuf to cmdfifo */
>           for (i = 0; i < s->mig_cmdlen; i++) {
> +            if (&s->cmdfifo.num >= &s->cmdfifo.capacity) {
> +                return -1;
> +            }
>               fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
>           }
>       }