vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

megasas: do not read iovec count more than once from frame 

Avoid TOC-TOU bugs depending on how the compiler behaves.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
master
Paolo Bonzini 2017-06-01 17:18:57 +02:00
parent 134550bf81
commit 24c0c77af5
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hw/scsi/megasas.c
View File

@ -675,15 +675,16 @@ out:
static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
{
dma_addr_t iov_pa, iov_size;
int iov_count;
cmd->flags = le16_to_cpu(cmd->frame->header.flags);
if (!cmd->frame->header.sge_count) {
iov_count = cmd->frame->header.sge_count;
if (!iov_count) {
trace_megasas_dcmd_zero_sge(cmd->index);
cmd->iov_size = 0;
return 0;
} else if (cmd->frame->header.sge_count > 1) {
trace_megasas_dcmd_invalid_sge(cmd->index,
cmd->frame->header.sge_count);
} else if (iov_count > 1) {
trace_megasas_dcmd_invalid_sge(cmd->index, iov_count);
cmd->iov_size = 0;
return -EINVAL;
}