From: Prasad J Pandit <pjp@fedoraproject.org>

While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
an off-by-one error could occur as 's->adp_reset' index is not
reset after reading the last sequence.

Reported-by: YY Z <bigbird475958471@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/scsi/megasas.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 84b8caf..804122a 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
     case MFI_SEQ:
         trace_megasas_mmio_writel("MFI_SEQ", val);
         /* Magic sequence to start ADP reset */
-        if (adp_reset_seq[s->adp_reset] == val) {
-            s->adp_reset++;
+        if (adp_reset_seq[s->adp_reset++] == val) {
+            if (s->adp_reset == 6) {
+                s->adp_reset = 0;
+                s->diag = MFI_DIAG_WRITE_ENABLE;
+            }
         } else {
             s->adp_reset = 0;
             s->diag = 0;
         }
-        if (s->adp_reset == 6) {
-            s->diag = MFI_DIAG_WRITE_ENABLE;
-        }
         break;
     case MFI_DIAG:
         trace_megasas_mmio_writel("MFI_DIAG", val);
-- 
2.9.3

+-- On Mon, 24 Apr 2017, P J P wrote --+
| While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
| an off-by-one error could occur as 's->adp_reset' index is not
| reset after reading the last sequence.
| 
| --- a/hw/scsi/megasas.c
| +++ b/hw/scsi/megasas.c
| @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
|      case MFI_SEQ:
|          trace_megasas_mmio_writel("MFI_SEQ", val);
|          /* Magic sequence to start ADP reset */
| -        if (adp_reset_seq[s->adp_reset] == val) {
| -            s->adp_reset++;
| +        if (adp_reset_seq[s->adp_reset++] == val) {
| +            if (s->adp_reset == 6) {
| +                s->adp_reset = 0;
| +                s->diag = MFI_DIAG_WRITE_ENABLE;
| +            }
|          } else {
|              s->adp_reset = 0;
|              s->diag = 0;
|          }
| -        if (s->adp_reset == 6) {
| -            s->diag = MFI_DIAG_WRITE_ENABLE;
| -        }
|          break;

Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

On 28/04/2017 10:35, P J P wrote:
> +-- On Mon, 24 Apr 2017, P J P wrote --+
> | While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
> | an off-by-one error could occur as 's->adp_reset' index is not
> | reset after reading the last sequence.
> | 
> | --- a/hw/scsi/megasas.c
> | +++ b/hw/scsi/megasas.c
> | @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
> |      case MFI_SEQ:
> |          trace_megasas_mmio_writel("MFI_SEQ", val);
> |          /* Magic sequence to start ADP reset */
> | -        if (adp_reset_seq[s->adp_reset] == val) {
> | -            s->adp_reset++;
> | +        if (adp_reset_seq[s->adp_reset++] == val) {
> | +            if (s->adp_reset == 6) {
> | +                s->adp_reset = 0;
> | +                s->diag = MFI_DIAG_WRITE_ENABLE;
> | +            }
> |          } else {
> |              s->adp_reset = 0;
> |              s->diag = 0;
> |          }
> | -        if (s->adp_reset == 6) {
> | -            s->diag = MFI_DIAG_WRITE_ENABLE;
> | -        }
> |          break;
> 
> Ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
> 

I've already queued this patch.

Paolo

+-- On Fri, 28 Apr 2017, Paolo Bonzini wrote --+
| > |          /* Magic sequence to start ADP reset */
| > | -        if (adp_reset_seq[s->adp_reset] == val) {
| > | -            s->adp_reset++;
| > | +        if (adp_reset_seq[s->adp_reset++] == val) {
| > | +            if (s->adp_reset == 6) {
| > | +                s->adp_reset = 0;
| > | +                s->diag = MFI_DIAG_WRITE_ENABLE;
| > | +            }
| > |          } else {
| > |              s->adp_reset = 0;
| > |              s->diag = 0;
| > |          }
| > | -        if (s->adp_reset == 6) {
| > | -            s->diag = MFI_DIAG_WRITE_ENABLE;
| > | -        }
| > |          break;
| 
| I've already queued this patch.

Oh, okay. Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F