From: Mark Cave-Ayland Date: Thu, 18 Nov 2021 10:03:26 +0000 (+0000) Subject: esp: ensure that async_len is reset to 0 during esp_hard_reset() X-Git-Tag: v6.2.0-rc2~13^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3f26c9757726918015d351fafc436b2888689985;p=thirdparty%2Fqemu.git esp: ensure that async_len is reset to 0 during esp_hard_reset() If a reset command is sent after data has been transferred into the SCSI buffer ensure that async_len is reset to 0. Otherwise a subsequent TI command assumes the SCSI buffer contains data to be transferred to the device causing it to dereference the stale async_buf pointer. Signed-off-by: Mark Cave-Ayland Fixes: https://gitlab.com/qemu-project/qemu/-/issues/724 Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20211118100327.29061-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini --- diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 84f935b549a..58d0edbd56d 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -894,6 +894,7 @@ void esp_hard_reset(ESPState *s) memset(s->wregs, 0, ESP_REGS); s->tchi_written = 0; s->ti_size = 0; + s->async_len = 0; fifo8_reset(&s->fifo); fifo8_reset(&s->cmdfifo); s->dma = 0;