From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
To: qemu-devel@nongnu.org, alxndr@bu.edu, laurent@vivier.eu,
pbonzini@redhat.com
Subject: [PATCH v2 4/6] esp: don't underflow fifo when writing to the device
Date: Wed, 17 Mar 2021 23:02:21 +0000 [thread overview]
Message-ID: <20210317230223.24854-5-mark.cave-ayland@ilande.co.uk> (raw)
In-Reply-To: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk>
When writing to the device make sure that the fifo is not empty, otherwise the
fifo will underflow triggering an assert.
Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
hw/scsi/esp.c | 28 ++++++++++++++++------------
1 file changed, 16 insertions(+), 12 deletions(-)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index ae362c9dfb..bb57125035 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -509,18 +509,20 @@ static void do_dma_pdma_cb(ESPState *s)
/* Copy FIFO data to device */
len = MIN(s->async_len, ESP_FIFO_SZ);
len = MIN(len, fifo8_num_used(&s->fifo));
- memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
- s->async_buf += n;
- s->async_len -= n;
- s->ti_size += n;
-
- if (n < len) {
- /* Unaligned accesses can cause FIFO wraparound */
- len = len - n;
+ if (len) {
memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
s->async_buf += n;
s->async_len -= n;
s->ti_size += n;
+
+ if (n < len) {
+ /* Unaligned accesses can cause FIFO wraparound */
+ len = len - n;
+ memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
+ s->async_buf += n;
+ s->async_len -= n;
+ s->ti_size += n;
+ }
}
if (s->async_len == 0) {
@@ -730,10 +732,12 @@ static void esp_do_nodma(ESPState *s)
if (to_device) {
len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
- memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
- s->async_buf += len;
- s->async_len -= len;
- s->ti_size += len;
+ if (len) {
+ memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
+ s->async_buf += len;
+ s->async_len -= len;
+ s->ti_size += len;
+ }
} else {
len = MIN(s->ti_size, s->async_len);
len = MIN(len, fifo8_num_free(&s->fifo));
--
2.20.1
next prev parent reply other threads:[~2021-03-17 23:08 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-17 23:02 [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 1/6] esp: don't underflow cmdfifo if no message out/command data is present Mark Cave-Ayland
2021-03-17 23:58 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 2/6] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-03-18 0:10 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL\ Alexander Bulekov
2021-03-17 23:02 ` Mark Cave-Ayland [this message]
2021-03-18 0:12 ` [PATCH v2 4/6] esp: don't underflow fifo when writing to the device Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-03-18 0:12 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 6/6] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-03-18 0:14 ` Alexander Bulekov
2021-03-18 12:10 ` Paolo Bonzini
2021-03-18 18:13 ` [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Paolo Bonzini
2021-03-30 7:34 ` Mark Cave-Ayland
2021-03-30 9:59 ` Paolo Bonzini
2021-04-01 7:56 ` Mark Cave-Ayland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210317230223.24854-5-mark.cave-ayland@ilande.co.uk \
--to=mark.cave-ayland@ilande.co.uk \
--cc=alxndr@bu.edu \
--cc=laurent@vivier.eu \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).