mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

megasas: do not read iovec count more than once from frame

Browse Source 
Avoid TOC-TOU bugs depending on how the compiler behaves.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2017-06-01 17:18:57 +02:00
parent 134550bf81
commit 24c0c77af5
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hw/scsi/megasas.c
View File

@ -675,15 +675,16 @@ out:
static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd) static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
{ {
dma_addr_t iov_pa, iov_size; dma_addr_t iov_pa, iov_size;
int iov_count;
cmd->flags = le16_to_cpu(cmd->frame->header.flags); cmd->flags = le16_to_cpu(cmd->frame->header.flags);
if (!cmd->frame->header.sge_count) { iov_count = cmd->frame->header.sge_count;
if (!iov_count) {
trace_megasas_dcmd_zero_sge(cmd->index); trace_megasas_dcmd_zero_sge(cmd->index);
cmd->iov_size = 0; cmd->iov_size = 0;
return 0; return 0;
} else if (cmd->frame->header.sge_count > 1) { } else if (iov_count > 1) {
trace_megasas_dcmd_invalid_sge(cmd->index, trace_megasas_dcmd_invalid_sge(cmd->index, iov_count);
cmd->frame->header.sge_count);
cmd->iov_size = 0; cmd->iov_size = 0;
return -EINVAL; return -EINVAL;
} }