]> git.ipfire.org Git - thirdparty/qemu.git/commit
hw/scsi/lsi53c895a: add missing decrement of reentrancy counter
authorSven Schnelle <svens@stackframe.org>
Sun, 28 Jan 2024 20:22:14 +0000 (21:22 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Fri, 9 Feb 2024 07:44:49 +0000 (10:44 +0300)
commitbbfcb0f7bcc1f905eee3997e56d42bb1e97de51d
treef378ae52d6db262a250e07d834dd9f3362891de8
parent3a970decfee1f82dcafce8b9e56bc1b382975f77
hw/scsi/lsi53c895a: add missing decrement of reentrancy counter

When the maximum count of SCRIPTS instructions is reached, the code
stops execution and returns, but fails to decrement the reentrancy
counter. This effectively renders the SCSI controller unusable
because on next entry the reentrancy counter is still above the limit.

This bug was seen on HP-UX 10.20 which seems to trigger SCRIPTS
loops.

Fixes: b987718bbb ("hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)")
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Message-ID: <20240128202214.2644768-1-svens@stackframe.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 8b09b7fe47082c69295a0fc0cc01b041b6385025)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/scsi/lsi53c895a.c