diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2017-04-24 17:36:34 +0530 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2017-05-05 12:09:59 +0200 |
| commit | 24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f (patch) | |
| tree | ddaa9601b9d0dc8f87f9d751da403d447e80c9e5 /hw | |
| parent | aab9e87e7a5d280bfbffaa4ea6e296c515c8dac2 (diff) | |
| download | qemu-24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f.zip qemu-24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f.tar.gz qemu-24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f.tar.bz2 | |
scsi: avoid an off-by-one error in megasas_mmio_write
While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
an off-by-one error could occur as 's->adp_reset' index is not
reset after reading the last sequence.
Reported-by: YY Z <bigbird475958471@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20170424120634.12268-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/scsi/megasas.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 84b8caf..804122a 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, case MFI_SEQ: trace_megasas_mmio_writel("MFI_SEQ", val); /* Magic sequence to start ADP reset */ - if (adp_reset_seq[s->adp_reset] == val) { - s->adp_reset++; + if (adp_reset_seq[s->adp_reset++] == val) { + if (s->adp_reset == 6) { + s->adp_reset = 0; + s->diag = MFI_DIAG_WRITE_ENABLE; + } } else { s->adp_reset = 0; s->diag = 0; } - if (s->adp_reset == 6) { - s->diag = MFI_DIAG_WRITE_ENABLE; - } break; case MFI_DIAG: trace_megasas_mmio_writel("MFI_DIAG", val); |