diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2021-11-18 10:03:26 +0000 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-11-19 10:14:30 +0100 |
| commit | 3f26c9757726918015d351fafc436b2888689985 (patch) | |
| tree | 01bdfc82371c3ec7e62a1b5e0bbb5f5ceb3eb87f /hw/scsi | |
| parent | 0cc4965049d9792ffede8fc371b58193d6ecbb02 (diff) | |
esp: ensure that async_len is reset to 0 during esp_hard_reset()
If a reset command is sent after data has been transferred into the SCSI buffer
ensure that async_len is reset to 0. Otherwise a subsequent TI command assumes
the SCSI buffer contains data to be transferred to the device causing it to
dereference the stale async_buf pointer.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/724
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20211118100327.29061-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi')
| -rw-r--r-- | hw/scsi/esp.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 84f935b549..58d0edbd56 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -894,6 +894,7 @@ void esp_hard_reset(ESPState *s) memset(s->wregs, 0, ESP_REGS); s->tchi_written = 0; s->ti_size = 0; + s->async_len = 0; fifo8_reset(&s->fifo); fifo8_reset(&s->cmdfifo); s->dma = 0; |