|
 |
3a13dd |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
3a13dd |
Date: Mon, 29 Aug 2016 11:35:37 +0200
|
|
|
3a13dd |
Subject: [PATCH] scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK
|
|
|
3a13dd |
|
|
|
3a13dd |
These issues cause respectively a QEMU crash and a leak of 2 bytes of
|
|
|
3a13dd |
stack. They were discovered by VictorV of 360 Marvel Team.
|
|
|
3a13dd |
|
|
|
3a13dd |
Reported-by: Tom Victor <i-tangtianwen@360.cm>
|
|
|
3a13dd |
Cc: qemu-stable@nongnu.org
|
|
|
3a13dd |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
3a13dd |
(cherry picked from commit 65a8e1f6413a0f6f79894da710b5d6d43361d27d)
|
|
|
3a13dd |
---
|
|
|
3a13dd |
hw/scsi/mptconfig.c | 4 ++--
|
|
|
3a13dd |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
3a13dd |
|
|
|
3a13dd |
diff --git a/hw/scsi/mptconfig.c b/hw/scsi/mptconfig.c
|
|
|
3a13dd |
index 3e4f400..87a416a 100644
|
|
|
3a13dd |
--- a/hw/scsi/mptconfig.c
|
|
|
3a13dd |
+++ b/hw/scsi/mptconfig.c
|
|
|
3a13dd |
@@ -203,7 +203,7 @@ size_t mptsas_config_manufacturing_1(MPTSASState *s, uint8_t **data, int address
|
|
|
3a13dd |
{
|
|
|
3a13dd |
/* VPD - all zeros */
|
|
|
3a13dd |
return MPTSAS_CONFIG_PACK(1, MPI_CONFIG_PAGETYPE_MANUFACTURING, 0x00,
|
|
|
3a13dd |
- "s256");
|
|
|
3a13dd |
+ "*s256");
|
|
|
3a13dd |
}
|
|
|
3a13dd |
|
|
|
3a13dd |
static
|
|
|
3a13dd |
@@ -328,7 +328,7 @@ size_t mptsas_config_ioc_0(MPTSASState *s, uint8_t **data, int address)
|
|
|
3a13dd |
return MPTSAS_CONFIG_PACK(0, MPI_CONFIG_PAGETYPE_IOC, 0x01,
|
|
|
3a13dd |
"*l*lwwb*b*b*blww",
|
|
|
3a13dd |
pcic->vendor_id, pcic->device_id, pcic->revision,
|
|
|
3a13dd |
- pcic->subsystem_vendor_id,
|
|
|
3a13dd |
+ pcic->class_id, pcic->subsystem_vendor_id,
|
|
|
3a13dd |
pcic->subsystem_id);
|
|
|
3a13dd |
}
|
|
|
3a13dd |
|