From 3f26c9757726918015d351fafc436b2888689985 Mon Sep 17 00:00:00 2001 From: Mark Cave-Ayland Date: Thu, 18 Nov 2021 10:03:26 +0000 Subject: [PATCH] esp: ensure that async_len is reset to 0 during esp_hard_reset() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a reset command is sent after data has been transferred into the SCSI buffer ensure that async_len is reset to 0. Otherwise a subsequent TI command assumes the SCSI buffer contains data to be transferred to the device causing it to dereference the stale async_buf pointer. Signed-off-by: Mark Cave-Ayland Fixes: https://gitlab.com/qemu-project/qemu/-/issues/724 Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20211118100327.29061-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini --- hw/scsi/esp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 84f935b549..58d0edbd56 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -894,6 +894,7 @@ void esp_hard_reset(ESPState *s) memset(s->wregs, 0, ESP_REGS); s->tchi_written = 0; s->ti_size = 0; + s->async_len = 0; fifo8_reset(&s->fifo); fifo8_reset(&s->cmdfifo); s->dma = 0;