]> git.proxmox.com Git - qemu.git/commit - hw/scsi-disk.c
scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command
authorThomas Higdon <thigdon@akamai.com>
Tue, 24 Jan 2012 17:19:44 +0000 (12:19 -0500)
committerKevin Wolf <kwolf@redhat.com>
Thu, 26 Jan 2012 13:49:18 +0000 (14:49 +0100)
commite2f0c49ffae8d3a00272c3cbc68850cc5aafbffa
tree767ec521762a5c8b60bdb7b6115e2f1970da14c6
parent2b16c9ffb2432f2d0f63647df6735a67b0333a51
scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command

Limit the return value (corresponding to the length of the buffer to be
DMAed back to the intiator) to the value in req->cmd.xfer, which is the
amount of data that the initiator expects. Eliminate now-duplicate code
that does this guarding in the functions for individual commands.

Without this, the SCRIPTS code in the emulated LSI device eventually
raises a DMA interrupt for a data overrun when an INQUIRY command whose
buflen exceeds req->cmd.xfer is processed. It's the responsibility of
the client to provide a request buffer and allocation length that are
large enough for the result of the command.

Signed-off-by: Thomas Higdon <thigdon@akamai.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
hw/scsi-disk.c