From: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> If a reset command is sent after data has been transferred into the SCSI buffer ensure that async_len is reset to 0. Otherwise a subsequent TI command assumes the SCSI buffer contains data to be transferred to the device causing it to dereference the stale async_buf pointer.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> Fixes: https://gitlab.com/qemu-project/qemu/-/issues/724 Reviewed-by: Philippe Mathieu-Daudé <phi...@redhat.com> Message-Id: <20211118100327.29061-2-mark.cave-ayl...@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- hw/scsi/esp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 84f935b549..58d0edbd56 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -894,6 +894,7 @@ void esp_hard_reset(ESPState *s) memset(s->wregs, 0, ESP_REGS); s->tchi_written = 0; s->ti_size = 0; + s->async_len = 0; fifo8_reset(&s->fifo); fifo8_reset(&s->cmdfifo); s->dma = 0; -- 2.33.1
