usb/storage: clear csw on reset

[PATCH] usb/storage: clear csw on reset

Gerd Hoffmann posted 1 patch 3 years, 1 month ago

Download mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20210312094954.796799-1-kraxel@redhat.com

Maintainers: Gerd Hoffmann <kraxel@redhat.com>

hw/usb/dev-storage.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[PATCH] usb/storage: clear csw on reset

Posted by Gerd Hoffmann 3 years, 1 month ago

Stale data in csw (specifically residue) can confuse the state machine
and allows the guest trigger an assert().  So clear csw on reset to
avoid this happening in case the guest resets the device in the middle
of a request.

Buglink: https://bugs.launchpad.net/qemu/+bug/1523811
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/dev-storage.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index a5f76fc00120..fd4ea818115c 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -352,6 +352,7 @@ static void usb_msd_handle_reset(USBDevice *dev)
         usb_msd_packet_complete(s);
     }
 
+    memset(&s->csw, 0, sizeof(s->csw));
     s->mode = USB_MSDM_CBW;
 }
 
-- 
2.29.2

Re: [PATCH] usb/storage: clear csw on reset

Posted by Philippe Mathieu-Daudé 3 years, 1 month ago

On 3/12/21 10:49 AM, Gerd Hoffmann wrote:
> Stale data in csw (specifically residue) can confuse the state machine
> and allows the guest trigger an assert().  So clear csw on reset to
> avoid this happening in case the guest resets the device in the middle
> of a request.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1523811
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/usb/dev-storage.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
> index a5f76fc00120..fd4ea818115c 100644
> --- a/hw/usb/dev-storage.c
> +++ b/hw/usb/dev-storage.c
> @@ -352,6 +352,7 @@ static void usb_msd_handle_reset(USBDevice *dev)
>          usb_msd_packet_complete(s);
>      }
>  
> +    memset(&s->csw, 0, sizeof(s->csw));

easy-peasy...

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

>      s->mode = USB_MSDM_CBW;
>  }