hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
When the maximum count of SCRIPTS instructions is reached, the code stops execution and returns, but fails to decrement the reentrancy counter. This effectively renders the SCSI controller unusable because on next entry the reentrancy counter is still above the limit. This bug was seen on HP-UX 10.20 which seems to trigger SCRIPTS loops. Fixes:b987718bbb
("hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)") Signed-off-by: Sven Schnelle <svens@stackframe.org> Message-ID: <20240128202214.2644768-1-svens@stackframe.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Helge Deller <deller@gmx.de> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit8b09b7fe47
) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
parent
3a970decfe
commit
bbfcb0f7bc
@ -1159,6 +1159,7 @@ again:
|
|||||||
lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
|
lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
|
||||||
lsi_disconnect(s);
|
lsi_disconnect(s);
|
||||||
trace_lsi_execute_script_stop();
|
trace_lsi_execute_script_stop();
|
||||||
|
reentrancy_level--;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
insn = read_dword(s, s->dsp);
|
insn = read_dword(s, s->dsp);
|
||||||
|
Loading…
Reference in New Issue
Block a user