[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write |
Date: |
Fri, 28 Apr 2017 11:54:25 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 |
On 28/04/2017 10:35, P J P wrote:
> +-- On Mon, 24 Apr 2017, P J P wrote --+
> | While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
> | an off-by-one error could occur as 's->adp_reset' index is not
> | reset after reading the last sequence.
> |
> | --- a/hw/scsi/megasas.c
> | +++ b/hw/scsi/megasas.c
> | @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr
> addr,
> | case MFI_SEQ:
> | trace_megasas_mmio_writel("MFI_SEQ", val);
> | /* Magic sequence to start ADP reset */
> | - if (adp_reset_seq[s->adp_reset] == val) {
> | - s->adp_reset++;
> | + if (adp_reset_seq[s->adp_reset++] == val) {
> | + if (s->adp_reset == 6) {
> | + s->adp_reset = 0;
> | + s->diag = MFI_DIAG_WRITE_ENABLE;
> | + }
> | } else {
> | s->adp_reset = 0;
> | s->diag = 0;
> | }
> | - if (s->adp_reset == 6) {
> | - s->diag = MFI_DIAG_WRITE_ENABLE;
> | - }
> | break;
>
> Ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
>
I've already queued this patch.
Paolo