1. Patchew
  2. QEMU
  3. View series

[PATCH] esp: process the result of scsi_device_find()

Alexandra Diupina posted 1 patch 11 months, 2 weeks ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20231218150213.27253-1-adiupina@astralinux.ru
Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Fam Zheng <fam@euphon.net>
There is a newer version of this series
hw/scsi/esp.c | 5 +++++
1 file changed, 5 insertions(+)
[PATCH] esp: process the result of scsi_device_find()
Posted by Alexandra Diupina 11 months, 2 weeks ago 
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
---
 hw/scsi/esp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9b11d8c573..3a2ec35f9b 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
 
     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
+
+    if (!current_lun) {
+        return;
+    }
+
     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
     datalen = scsi_req_enqueue(s->current_req);
     s->ti_size = datalen;
-- 
2.30.2
Re: [PATCH] esp: process the result of scsi_device_find()
Posted by Philippe Mathieu-Daudé 11 months ago 
Cc'ing Mark for the logical change (should we rather assert?).

On 18/12/23 16:02, Alexandra Diupina wrote:
> Add a 'current_lun' check for a null value
> to avoid null pointer dereferencing
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
> ---
>   hw/scsi/esp.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index 9b11d8c573..3a2ec35f9b 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
>       esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>   
>       current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
> +
> +    if (!current_lun) {
> +        return;
> +    }
> +
>       s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
>       datalen = scsi_req_enqueue(s->current_req);
>       s->ti_size = datalen;
Re: [PATCH] esp: process the result of scsi_device_find()
Posted by Mark Cave-Ayland 11 months ago 
On 26/12/2023 12:08, Philippe Mathieu-Daudé wrote:

> Cc'ing Mark for the logical change (should we rather assert?).
> 
> On 18/12/23 16:02, Alexandra Diupina wrote:
>> Add a 'current_lun' check for a null value
>> to avoid null pointer dereferencing
>>
>> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>>
>> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
>> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
>> ---
>>   hw/scsi/esp.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
>> index 9b11d8c573..3a2ec35f9b 100644
>> --- a/hw/scsi/esp.c
>> +++ b/hw/scsi/esp.c
>> @@ -292,6 +292,11 @@ static void do_command_phase(ESPState *s)
>>       esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>>       current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
>> +
>> +    if (!current_lun) {
>> +        return;
>> +    }
>> +
>>       s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
>>       datalen = scsi_req_enqueue(s->current_req);
>>       s->ti_size = datalen;

Checking for the NULL return from scsi_device_find() looks correct to me, but I don't 
think that a simple return will allow the host to recover. I suspect the right thing 
to do here is to duplicate the scsi_device_find() logic just above i.e. set the 
INTR_DC bit and then raise the IRQ if NULL is returned.


ATB,

Mark.
[PATCH v2] esp: process the result of scsi_device_find()
Posted by Alexandra Diupina 11 months ago 
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing and
recover host if NULL return

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
---
v2: duplicate the scsi_device_find() logic from esp_select()
 hw/scsi/esp.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 9b11d8c573..03fdd53de6 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -292,6 +292,16 @@ static void do_command_phase(ESPState *s)
     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
 
     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
+
+    if (!current_lun) {
+        /* No such drive */
+        s->rregs[ESP_RSTAT] = 0;
+        s->rregs[ESP_RINTR] = INTR_DC;
+        s->rregs[ESP_RSEQ] = SEQ_0;
+        esp_raise_irq(s);
+        return;
+    }
+
     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
     datalen = scsi_req_enqueue(s->current_req);
     s->ti_size = datalen;
-- 
2.30.2
Re: [PATCH v2] esp: process the result of scsi_device_find()
Posted by Paolo Bonzini 11 months ago 
Queued, thanks.

Paolo
Re: [PATCH v2] esp: process the result of scsi_device_find()
Posted by Philippe Mathieu-Daudé 11 months ago 
Cc'ing Mark.

On 29/12/23 16:26, Alexandra Diupina wrote:
> Add a 'current_lun' check for a null value
> to avoid null pointer dereferencing and
> recover host if NULL return
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
> Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
> ---
> v2: duplicate the scsi_device_find() logic from esp_select()
>   hw/scsi/esp.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
> index 9b11d8c573..03fdd53de6 100644
> --- a/hw/scsi/esp.c
> +++ b/hw/scsi/esp.c
> @@ -292,6 +292,16 @@ static void do_command_phase(ESPState *s)
>       esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
>   
>       current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
> +
> +    if (!current_lun) {
> +        /* No such drive */
> +        s->rregs[ESP_RSTAT] = 0;
> +        s->rregs[ESP_RINTR] = INTR_DC;
> +        s->rregs[ESP_RSEQ] = SEQ_0;
> +        esp_raise_irq(s);
> +        return;
> +    }
> +
>       s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
>       datalen = scsi_req_enqueue(s->current_req);
>       s->ti_size = datalen;

Patchew 2.1-devel-b67e4c2

© 2016 - 2024 Red Hat, Inc.