diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2017-04-24 17:36:34 +0530 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2017-08-31 11:51:16 -0500 |
| commit | 0f590e798fe6a8bbff4c5b833f4e751dd98d7aa4 (patch) | |
| tree | 7db8c791b1387bca187ca37c37890a836cf257f5 | |
| parent | 3c6913263555bf43963d6ee8aa30b0ce1bd89b8d (diff) | |
| download | qemu-0f590e798fe6a8bbff4c5b833f4e751dd98d7aa4.tar.gz | |
scsi: avoid an off-by-one error in megasas_mmio_write
While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
an off-by-one error could occur as 's->adp_reset' index is not
reset after reading the last sequence.
Reported-by: YY Z <bigbird475958471@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20170424120634.12268-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/scsi/megasas.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 84b8caf901..804122ab05 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, case MFI_SEQ: trace_megasas_mmio_writel("MFI_SEQ", val); /* Magic sequence to start ADP reset */ - if (adp_reset_seq[s->adp_reset] == val) { - s->adp_reset++; + if (adp_reset_seq[s->adp_reset++] == val) { + if (s->adp_reset == 6) { + s->adp_reset = 0; + s->diag = MFI_DIAG_WRITE_ENABLE; + } } else { s->adp_reset = 0; s->diag = 0; } - if (s->adp_reset == 6) { - s->diag = MFI_DIAG_WRITE_ENABLE; - } break; case MFI_DIAG: trace_megasas_mmio_writel("MFI_DIAG", val); |