diff mbox series

[2/4] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size

Message ID 20210316233024.13560-3-mark.cave-ayland@ilande.co.uk
State New
Headers show
Series esp: fix asserts/segfaults discovered by fuzzer | expand

Commit Message

Mark Cave-Ayland March 16, 2021, 11:30 p.m. UTC 
If a guest transfers the message out/command phase data using DMA with a TC
that is larger than the cmdfifo size then the cmdfifo overflows triggering
an assert. Limit the size of the transfer to the free space available in
cmdfifo.

Buglink: https://bugs.launchpad.net/qemu/+bug/1919036
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 hw/scsi/esp.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Philippe Mathieu-Daudé March 17, 2021, 12:19 a.m. UTC | #1 
On 3/17/21 12:30 AM, Mark Cave-Ayland wrote:
> If a guest transfers the message out/command phase data using DMA with a TC
> that is larger than the cmdfifo size then the cmdfifo overflows triggering
> an assert. Limit the size of the transfer to the free space available in
> cmdfifo.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1919036
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> ---
>  hw/scsi/esp.c | 1 +
>  1 file changed, 1 insertion(+)

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Alexander Bulekov March 17, 2021, 4:07 p.m. UTC | #2 
On 210316 2330, Mark Cave-Ayland wrote:
> If a guest transfers the message out/command phase data using DMA with a TC
> that is larger than the cmdfifo size then the cmdfifo overflows triggering
> an assert. Limit the size of the transfer to the free space available in
> cmdfifo.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1919036
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> ---
>  hw/scsi/esp.c | 1 +
>  1 file changed, 1 insertion(+)

Tested-by: Alexander Bulekov <alxndr@bu.edu>
diff mbox series

Patch

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 5d3f1ccbc8..bbcbfa4a91 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -579,6 +579,7 @@  static void esp_do_dma(ESPState *s)
         cmdlen = fifo8_num_used(&s->cmdfifo);
         trace_esp_do_dma(cmdlen, len);
         if (s->dma_memory_read) {
+            len = MIN(len, fifo8_num_free(&s->cmdfifo));
             s->dma_memory_read(s->dma_opaque, buf, len);
             fifo8_push_all(&s->cmdfifo, buf, len);
         } else {