Re: [Qemu-devel] [PATCH 2/7] megasas: do not read sense length more than once from frame

[Philippe Mathieu-Daudé]

Hi Paolo,

Should this patch go in qemu-stable?

On 06/06/2017 09:17 AM, Paolo Bonzini wrote:
> Avoid TOC-TOU bugs depending on how the compiler behaves.

Can you be more descriptive here? Which compiler? (thinking about how to 
prevent this class of bugs).

Regards,

Phil.

> Signed-off-by: Paolo Bonzini <address@hidden>
> ---
>  hw/scsi/megasas.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> index 804122ab05..1888118e5f 100644
> --- a/hw/scsi/megasas.c
> +++ b/hw/scsi/megasas.c
> @@ -309,9 +309,11 @@ static int megasas_build_sense(MegasasCmd *cmd, uint8_t 
> *sense_ptr,
>      PCIDevice *pcid = PCI_DEVICE(cmd->state);
>      uint32_t pa_hi = 0, pa_lo;
>      hwaddr pa;
> +    int frame_sense_len;
>
> -    if (sense_len > cmd->frame->header.sense_len) {
> -        sense_len = cmd->frame->header.sense_len;
> +    frame_sense_len = cmd->frame->header.sense_len;
> +    if (sense_len > frame_sense_len) {
> +        sense_len = frame_sense_len;
>      }
>      if (sense_len) {
>          pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);