Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write

[Paolo Bonzini]

On 28/04/2017 10:35, P J P wrote:
> +-- On Mon, 24 Apr 2017, P J P wrote --+
> | While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
> | an off-by-one error could occur as 's->adp_reset' index is not
> | reset after reading the last sequence.
> | 
> | --- a/hw/scsi/megasas.c
> | +++ b/hw/scsi/megasas.c
> | @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr 
> addr,
> |      case MFI_SEQ:
> |          trace_megasas_mmio_writel("MFI_SEQ", val);
> |          /* Magic sequence to start ADP reset */
> | -        if (adp_reset_seq[s->adp_reset] == val) {
> | -            s->adp_reset++;
> | +        if (adp_reset_seq[s->adp_reset++] == val) {
> | +            if (s->adp_reset == 6) {
> | +                s->adp_reset = 0;
> | +                s->diag = MFI_DIAG_WRITE_ENABLE;
> | +            }
> |          } else {
> |              s->adp_reset = 0;
> |              s->diag = 0;
> |          }
> | -        if (s->adp_reset == 6) {
> | -            s->diag = MFI_DIAG_WRITE_ENABLE;
> | -        }
> |          break;
> 
> Ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
> 

I've already queued this patch.

Paolo