qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
To: qemu-devel@nongnu.org, alxndr@bu.edu, laurent@vivier.eu,
	pbonzini@redhat.com
Subject: [PATCH v2 4/6] esp: don't underflow fifo when writing to the device
Date: Wed, 17 Mar 2021 23:02:21 +0000	[thread overview]
Message-ID: <20210317230223.24854-5-mark.cave-ayland@ilande.co.uk> (raw)
In-Reply-To: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk>

When writing to the device make sure that the fifo is not empty, otherwise the
fifo will underflow triggering an assert.

Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 hw/scsi/esp.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index ae362c9dfb..bb57125035 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -509,18 +509,20 @@ static void do_dma_pdma_cb(ESPState *s)
         /* Copy FIFO data to device */
         len = MIN(s->async_len, ESP_FIFO_SZ);
         len = MIN(len, fifo8_num_used(&s->fifo));
-        memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
-        s->async_buf += n;
-        s->async_len -= n;
-        s->ti_size += n;
-
-        if (n < len) {
-            /* Unaligned accesses can cause FIFO wraparound */
-            len = len - n;
+        if (len) {
             memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
             s->async_buf += n;
             s->async_len -= n;
             s->ti_size += n;
+
+            if (n < len) {
+                /* Unaligned accesses can cause FIFO wraparound */
+                len = len - n;
+                memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
+                s->async_buf += n;
+                s->async_len -= n;
+                s->ti_size += n;
+            }
         }
 
         if (s->async_len == 0) {
@@ -730,10 +732,12 @@ static void esp_do_nodma(ESPState *s)
 
     if (to_device) {
         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
-        memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
-        s->async_buf += len;
-        s->async_len -= len;
-        s->ti_size += len;
+        if (len) {
+            memcpy(s->async_buf, fifo8_pop_buf(&s->fifo, len, &n), len);
+            s->async_buf += len;
+            s->async_len -= len;
+            s->ti_size += len;
+        }
     } else {
         len = MIN(s->ti_size, s->async_len);
         len = MIN(len, fifo8_num_free(&s->fifo));
-- 
2.20.1



  parent reply	other threads:[~2021-03-17 23:08 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-17 23:02 [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 1/6] esp: don't underflow cmdfifo if no message out/command data is present Mark Cave-Ayland
2021-03-17 23:58   ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 2/6] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-03-18  0:10   ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL\ Alexander Bulekov
2021-03-17 23:02 ` Mark Cave-Ayland [this message]
2021-03-18  0:12   ` [PATCH v2 4/6] esp: don't underflow fifo when writing to the device Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-03-18  0:12   ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 6/6] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-03-18  0:14   ` Alexander Bulekov
2021-03-18 12:10   ` Paolo Bonzini
2021-03-18 18:13 ` [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Paolo Bonzini
2021-03-30  7:34   ` Mark Cave-Ayland
2021-03-30  9:59     ` Paolo Bonzini
2021-04-01  7:56       ` Mark Cave-Ayland

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210317230223.24854-5-mark.cave-ayland@ilande.co.uk \
    --to=mark.cave-ayland@ilande.co.uk \
    --cc=alxndr@bu.edu \
    --cc=laurent@vivier.eu \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).