esp: add fix for reset before transfer

[PATCH for-6.2 0/2] esp: add fix for reset before transfer

Mark Cave-Ayland posted 2 patches 2 years, 5 months ago

Download series mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20211118100327.29061-1-mark.cave-ayland@ilande.co.uk

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Laurent Vivier <lvivier@redhat.com>, Thomas Huth <thuth@redhat.com>, Fam Zheng <fam@euphon.net>

hw/scsi/esp.c               |  1 +
tests/qtest/am53c974-test.c | 30 ++++++++++++++++++++++++++++++
2 files changed, 31 insertions(+)

Expand all Fold all

[PATCH for-6.2 0/2] esp: add fix for reset before transfer

Posted by Mark Cave-Ayland 2 years, 5 months ago

This is the fix for Gitlab issue #724 discovered by fuzzing which I think is
worth including in 6.2 for 2 reasons: firstly the fix is to zero out
an extra field during chip reset which normally only occurs during driver
initialisation and durring IO timeouts, and secondly the bug causes a stale
SCSI data buffer pointer dereference rather than triggering a FIFO assert.

The first patch contains the very simple fix, whilst the second patch adds a
qtest based upon the original Gitlab issue.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>


Mark Cave-Ayland (2):
  esp: ensure that async_len is reset to 0 during esp_hard_reset()
  qtest/am53c974-test: add test for reset before transfer

 hw/scsi/esp.c               |  1 +
 tests/qtest/am53c974-test.c | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

-- 
2.20.1

Re: [PATCH for-6.2 0/2] esp: add fix for reset before transfer

Posted by Paolo Bonzini 2 years, 5 months ago

On 11/18/21 11:03, Mark Cave-Ayland wrote:
> This is the fix for Gitlab issue #724 discovered by fuzzing which I think is
> worth including in 6.2 for 2 reasons: firstly the fix is to zero out
> an extra field during chip reset which normally only occurs during driver
> initialisation and durring IO timeouts, and secondly the bug causes a stale
> SCSI data buffer pointer dereference rather than triggering a FIFO assert.
> 
> The first patch contains the very simple fix, whilst the second patch adds a
> qtest based upon the original Gitlab issue.
> 
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> 
> 
> Mark Cave-Ayland (2):
>    esp: ensure that async_len is reset to 0 during esp_hard_reset()
>    qtest/am53c974-test: add test for reset before transfer
> 
>   hw/scsi/esp.c               |  1 +
>   tests/qtest/am53c974-test.c | 30 ++++++++++++++++++++++++++++++
>   2 files changed, 31 insertions(+)
> 

Queued, thanks.

Paolo