]> git.proxmox.com Git - mirror_qemu.git/commit
scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE
authorMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Sat, 30 Jul 2022 12:26:55 +0000 (13:26 +0100)
committerPaolo Bonzini <pbonzini@redhat.com>
Mon, 1 Aug 2022 13:22:39 +0000 (15:22 +0200)
commit54a53a006ed9c1fe027fd89045d6de1e9128d7f4
tree92f03f7582fe827f370abceb284420dae33ae16a
parent3916603e0c1d909e14e09d5ebcbdaa9c9e21adf3
scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE

In scsi_disk_emulate_write_same() the number of host sectors to transfer is
calculated as (s->qdev.blocksize / BDRV_SECTOR_SIZE) which is then used to
copy data in block size chunks to the iov buffer.

Since the loop copying the data to the iov buffer uses a fixed increment of
s->qdev.blocksize then using a block size that isn't a multiple of
BDRV_SECTOR_SIZE introduces a rounding error in the iov buffer size calculation
such that the iov buffer copy overflows the space allocated.

Update the iov buffer copy for() loop so that it will use the smallest of either
the current block size or the remaining transfer count to prevent the overflow.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20220730122656.253448-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
hw/scsi/scsi-disk.c