qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v3] scsi: esp: check TI buffer index before read/write
@ 2016-06-06 16:34 P J P
  2016-06-06 16:57 ` Paolo Bonzini
  0 siblings, 1 reply; 2+ messages in thread
From: P J P @ 2016-06-06 16:34 UTC (permalink / raw)
  To: Qemu Developers
  Cc: Paolo Bonzini, Peter Maydell, Li Qiang, Huawei PSIRT,
	Prasad J Pandit

From: Prasad J Pandit <pjp@fedoraproject.org>

The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte
FIFO buffers. One is used to handle commands and other is for
information transfer. Three control variables 'ti_rptr',
'ti_wptr' and 'ti_size' are used to control r/w access to the
information transfer buffer ti_buf[TI_BUFSZ=16]. In that,

'ti_rptr' is used as read index, where read occurs.
'ti_wptr' is a write index, where write would occur.
'ti_size' indicates total bytes to be read from the buffer.

While reading/writing to this buffer, index could exceed its
size. Add check to avoid OOB r/w access.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/scsi/esp.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

Update as per:
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01326.html

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index c2f6f8f..4b94bbc 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -403,19 +403,17 @@ uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
     trace_esp_mem_readb(saddr, s->rregs[saddr]);
     switch (saddr) {
     case ESP_FIFO:
-        if (s->ti_size > 0) {
+        if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
+            /* Data out.  */
+            qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
+            s->rregs[ESP_FIFO] = 0;
+            esp_raise_irq(s);
+        } else if (s->ti_rptr < s->ti_wptr) {
             s->ti_size--;
-            if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
-                /* Data out.  */
-                qemu_log_mask(LOG_UNIMP,
-                              "esp: PIO data read not implemented\n");
-                s->rregs[ESP_FIFO] = 0;
-            } else {
-                s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
-            }
+            s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
             esp_raise_irq(s);
         }
-        if (s->ti_size == 0) {
+        if (s->ti_rptr == s->ti_wptr) {
             s->ti_rptr = 0;
             s->ti_wptr = 0;
         }
@@ -459,7 +457,7 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
             } else {
                 trace_esp_error_fifo_overrun();
             }
-        } else if (s->ti_size == TI_BUFSZ - 1) {
+        } else if (s->ti_wptr == TI_BUFSZ - 1) {
             trace_esp_error_fifo_overrun();
         } else {
             s->ti_size++;
-- 
2.5.5

^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [Qemu-devel] [PATCH v3] scsi: esp: check TI buffer index before read/write
  2016-06-06 16:34 [Qemu-devel] [PATCH v3] scsi: esp: check TI buffer index before read/write P J P
@ 2016-06-06 16:57 ` Paolo Bonzini
  0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2016-06-06 16:57 UTC (permalink / raw)
  To: P J P, Qemu Developers
  Cc: Peter Maydell, Li Qiang, Huawei PSIRT, Prasad J Pandit



On 06/06/2016 18:34, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte
> FIFO buffers. One is used to handle commands and other is for
> information transfer. Three control variables 'ti_rptr',
> 'ti_wptr' and 'ti_size' are used to control r/w access to the
> information transfer buffer ti_buf[TI_BUFSZ=16]. In that,
> 
> 'ti_rptr' is used as read index, where read occurs.
> 'ti_wptr' is a write index, where write would occur.
> 'ti_size' indicates total bytes to be read from the buffer.
> 
> While reading/writing to this buffer, index could exceed its
> size. Add check to avoid OOB r/w access.
> 
> Reported-by: Huawei PSIRT <psirt@huawei.com>
> Reported-by: Li Qiang <liqiang6-s@360.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  hw/scsi/esp.c | 20 +++++++++-----------
>  1 file changed, 9 insertions(+), 11 deletions(-)
> 
> Update as per:
>   -> https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg01326.html
> 
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index c2f6f8f..4b94bbc 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -403,19 +403,17 @@ uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
>      trace_esp_mem_readb(saddr, s->rregs[saddr]);
>      switch (saddr) {
>      case ESP_FIFO:
> -        if (s->ti_size > 0) {
> +        if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
> +            /* Data out.  */
> +            qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
> +            s->rregs[ESP_FIFO] = 0;
> +            esp_raise_irq(s);
> +        } else if (s->ti_rptr < s->ti_wptr) {
>              s->ti_size--;
> -            if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
> -                /* Data out.  */
> -                qemu_log_mask(LOG_UNIMP,
> -                              "esp: PIO data read not implemented\n");
> -                s->rregs[ESP_FIFO] = 0;
> -            } else {
> -                s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
> -            }
> +            s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
>              esp_raise_irq(s);
>          }
> -        if (s->ti_size == 0) {
> +        if (s->ti_rptr == s->ti_wptr) {
>              s->ti_rptr = 0;
>              s->ti_wptr = 0;
>          }
> @@ -459,7 +457,7 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
>              } else {
>                  trace_esp_error_fifo_overrun();
>              }
> -        } else if (s->ti_size == TI_BUFSZ - 1) {
> +        } else if (s->ti_wptr == TI_BUFSZ - 1) {
>              trace_esp_error_fifo_overrun();
>          } else {
>              s->ti_size++;
> 

Queued, thanks.

Paolo

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2016-06-06 16:57 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-06 16:34 [Qemu-devel] [PATCH v3] scsi: esp: check TI buffer index before read/write P J P
2016-06-06 16:57 ` Paolo Bonzini

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).