From: Alexander Bulekov <alxndr@bu.edu>
To: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Cc: pbonzini@redhat.com, qemu-devel@nongnu.org, laurent@vivier.eu
Subject: Re: [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL\
Date: Wed, 17 Mar 2021 20:10:46 -0400 [thread overview]
Message-ID: <20210318001046.saj4s7fzzjuarprc@mozz.bu.edu> (raw)
In-Reply-To: <20210317230223.24854-4-mark.cave-ayland@ilande.co.uk>
On 210317 2302, Mark Cave-Ayland wrote:
> When about to execute a SCSI command, ensure that cmdfifo is not empty and
> current_dev is non-NULL. This can happen if the guest tries to execute a TI
> (Transfer Information) command without issuing one of the select commands
> first.
>
> Buglink: https://bugs.launchpad.net/qemu/+bug/1910723
> Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> ---
> hw/scsi/esp.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index bbcbfa4a91..ae362c9dfb 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -286,6 +286,9 @@ static void do_busid_cmd(ESPState *s, uint8_t busid)
> trace_esp_do_busid_cmd(busid);
> lun = busid & 7;
> cmdlen = fifo8_num_used(&s->cmdfifo);
> + if (!cmdlen || !s->current_dev) {
> + return;
> + }
> buf = (uint8_t *)fifo8_pop_buf(&s->cmdfifo, cmdlen, &n);
>
> current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
> --
> 2.20.1
>
next prev parent reply other threads:[~2021-03-18 0:13 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-17 23:02 [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 1/6] esp: don't underflow cmdfifo if no message out/command data is present Mark Cave-Ayland
2021-03-17 23:58 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 2/6] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-03-18 0:10 ` Alexander Bulekov [this message]
2021-03-17 23:02 ` [PATCH v2 4/6] esp: don't underflow fifo when writing to the device Mark Cave-Ayland
2021-03-18 0:12 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-03-18 0:12 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 6/6] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-03-18 0:14 ` Alexander Bulekov
2021-03-18 12:10 ` Paolo Bonzini
2021-03-18 18:13 ` [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Paolo Bonzini
2021-03-30 7:34 ` Mark Cave-Ayland
2021-03-30 9:59 ` Paolo Bonzini
2021-04-01 7:56 ` Mark Cave-Ayland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210318001046.saj4s7fzzjuarprc@mozz.bu.edu \
--to=alxndr@bu.edu \
--cc=laurent@vivier.eu \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).