From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:46996)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1b9tCp-0006xL-0u
	for qemu-devel@nongnu.org; Mon, 06 Jun 2016 08:00:31 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1b9tCi-0002wJ-7L
	for qemu-devel@nongnu.org; Mon, 06 Jun 2016 08:00:30 -0400
Received: from mail-wm0-x233.google.com ([2a00:1450:400c:c09::233]:36465)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1b9tCi-0002vW-03
	for qemu-devel@nongnu.org; Mon, 06 Jun 2016 08:00:24 -0400
Received: by mail-wm0-x233.google.com with SMTP id n184so88723537wmn.1
	for <qemu-devel@nongnu.org>; Mon, 06 Jun 2016 05:00:23 -0700 (PDT)
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
References: <1464694581-31596-1-git-send-email-ppandit@redhat.com>
From: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <c0f4e9fb-d194-fecb-c5e7-3634b19a6cf6@redhat.com>
Date: Mon, 6 Jun 2016 14:00:03 +0200
MIME-Version: 1.0
In-Reply-To: <1464694581-31596-1-git-send-email-ppandit@redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH v2] scsi: esp: check TI buffer index before
 read/write
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: P J P <ppandit@redhat.com>, Qemu Developers <qemu-devel@nongnu.org>
Cc: Li Qiang <liqiang6-s@360.cn>, Peter Maydell <peter.maydell@linaro.org>, Huawei PSIRT <PSIRT@huawei.com>, Prasad J Pandit <pjp@fedoraproject.org>



On 31/05/2016 13:36, P J P wrote:
> +        if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
> +            /* Data out.  */
> +            qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
> +            s->rregs[ESP_FIFO] = 0;
> +            esp_raise_irq(s);
> +        } else if (s->ti_rptr < s->ti_wptr) {
>              s->ti_size--;
> -            if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
> -                /* Data out.  */
> -                qemu_log_mask(LOG_UNIMP,
> -                              "esp: PIO data read not implemented\n");
> -                s->rregs[ESP_FIFO] = 0;
> -            } else {
> -                s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
> -            }
> +            s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
>              esp_raise_irq(s);
>          }
>          if (s->ti_size == 0) {

Shouldn't this become a "s->ti_rptr == s->ti_wptr" too?

Thanks,

Paolo