From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
To: qemu-devel@nongnu.org, alxndr@bu.edu
Subject: [PATCH 1/4] esp: don't underflow cmdfifo if no message out/command data is present
Date: Tue, 16 Mar 2021 23:30:21 +0000 [thread overview]
Message-ID: <20210316233024.13560-2-mark.cave-ayland@ilande.co.uk> (raw)
In-Reply-To: <20210316233024.13560-1-mark.cave-ayland@ilande.co.uk>
If a guest sends a TI (Transfer Information) command without previously sending
any message out/command phase data then cmdfifo will underflow triggering an
assert reading the IDENTIFY byte.
Buglink: https://bugs.launchpad.net/qemu/+bug/1919035
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
hw/scsi/esp.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 507ab363bc..5d3f1ccbc8 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -318,18 +318,24 @@ static void do_busid_cmd(ESPState *s, uint8_t busid)
static void do_cmd(ESPState *s)
{
- uint8_t busid = fifo8_pop(&s->cmdfifo);
+ uint8_t busid;
uint32_t n;
- s->cmdfifo_cdb_offset--;
+ if (fifo8_num_used(&s->cmdfifo)) {
+ busid = fifo8_pop(&s->cmdfifo);
- /* Ignore extended messages for now */
- if (s->cmdfifo_cdb_offset) {
- fifo8_pop_buf(&s->cmdfifo, s->cmdfifo_cdb_offset, &n);
- s->cmdfifo_cdb_offset = 0;
- }
+ if (s->cmdfifo_cdb_offset) {
+ s->cmdfifo_cdb_offset--;
+
+ /* Ignore extended messages for now */
+ if (s->cmdfifo_cdb_offset) {
+ fifo8_pop_buf(&s->cmdfifo, s->cmdfifo_cdb_offset, &n);
+ s->cmdfifo_cdb_offset = 0;
+ }
+ }
- do_busid_cmd(s, busid);
+ do_busid_cmd(s, busid);
+ }
}
static void satn_pdma_cb(ESPState *s)
--
2.20.1
next prev parent reply other threads:[~2021-03-16 23:32 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-16 23:30 [PATCH 0/4] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-16 23:30 ` Mark Cave-Ayland [this message]
2021-03-17 15:14 ` [PATCH 1/4] esp: don't underflow cmdfifo if no message out/command data is present Alexander Bulekov
2021-03-17 16:07 ` Alexander Bulekov
2021-03-17 15:37 ` Alexander Bulekov
2021-03-16 23:30 ` [PATCH 2/4] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-03-17 0:19 ` Philippe Mathieu-Daudé
2021-03-17 16:07 ` Alexander Bulekov
2021-03-16 23:30 ` [PATCH 3/4] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-03-17 0:18 ` Philippe Mathieu-Daudé
2021-03-17 15:47 ` Alexander Bulekov
2021-03-16 23:30 ` [PATCH 4/4] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-03-17 0:20 ` [PATCH 0/4] esp: fix asserts/segfaults discovered by fuzzer Philippe Mathieu-Daudé
2021-03-17 7:59 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210316233024.13560-2-mark.cave-ayland@ilande.co.uk \
--to=mark.cave-ayland@ilande.co.uk \
--cc=alxndr@bu.edu \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.