The type of cmd->frame is mfi_frame. So it should be able to hold the whole mfi_io_frame, including union mfi_sgl sgl. But only frame_size bytes are allocated, which is enough to store union mfi_sgl sgl only.
Signed-off-by: Dmitry Frolov <[email protected]> --- hw/scsi/megasas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 9e712721f8..0ddd11ccda 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -488,7 +488,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s, { PCIDevice *pcid = PCI_DEVICE(s); MegasasCmd *cmd = NULL; - int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl); + int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl) + MFI_FRAME_SIZE; hwaddr frame_size_p = frame_size; unsigned long index; -- 2.34.1
