Commit 24dfa9fa authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Paolo Bonzini
Browse files

scsi: avoid an off-by-one error in megasas_mmio_write 



While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
an off-by-one error could occur as 's->adp_reset' index is not
reset after reading the last sequence.

Reported-by: default avatarYY Z <bigbird475958471@gmail.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20170424120634.12268-1-ppandit@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent aab9e87e

hw/scsi/megasas.c

+5 −5
Original line number Diff line number Diff line
@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, 
    case MFI_SEQ:

        trace_megasas_mmio_writel("MFI_SEQ", val);

        /* Magic sequence to start ADP reset */

        if (adp_reset_seq[s->adp_reset] == val) {

            s->adp_reset++;

        if (adp_reset_seq[s->adp_reset++] == val) {

            if (s->adp_reset == 6) {

                s->adp_reset = 0;

                s->diag = MFI_DIAG_WRITE_ENABLE;

            }

        } else {

            s->adp_reset = 0;

            s->diag = 0;

        }

        if (s->adp_reset == 6) {

            s->diag = MFI_DIAG_WRITE_ENABLE;

        }

        break;

    case MFI_DIAG:

        trace_megasas_mmio_writel("MFI_DIAG", val);