Re: [Qemu-devel] [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write

[P J P]

+-- On Mon, 24 Apr 2017, P J P wrote --+
| While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
| an off-by-one error could occur as 's->adp_reset' index is not
| reset after reading the last sequence.
| 
| --- a/hw/scsi/megasas.c
| +++ b/hw/scsi/megasas.c
| @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr 
addr,
|      case MFI_SEQ:
|          trace_megasas_mmio_writel("MFI_SEQ", val);
|          /* Magic sequence to start ADP reset */
| -        if (adp_reset_seq[s->adp_reset] == val) {
| -            s->adp_reset++;
| +        if (adp_reset_seq[s->adp_reset++] == val) {
| +            if (s->adp_reset == 6) {
| +                s->adp_reset = 0;
| +                s->diag = MFI_DIAG_WRITE_ENABLE;
| +            }
|          } else {
|              s->adp_reset = 0;
|              s->diag = 0;
|          }
| -        if (s->adp_reset == 6) {
| -            s->diag = MFI_DIAG_WRITE_ENABLE;
| -        }
|          break;

Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F