ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command 

Limit the return value (corresponding to the length of the buffer to be
DMAed back to the intiator) to the value in req->cmd.xfer, which is the
amount of data that the initiator expects. Eliminate now-duplicate code
that does this guarding in the functions for individual commands.

Without this, the SCRIPTS code in the emulated LSI device eventually
raises a DMA interrupt for a data overrun when an INQUIRY command whose
buflen exceeds req->cmd.xfer is processed. It's the responsibility of
the client to provide a request buffer and allocation length that are
large enough for the result of the command.

Signed-off-by: Thomas Higdon <thigdon@akamai.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Thomas Higdon 2012-01-24 12:19:44 -05:00 committed by Kevin Wolf
parent 2b16c9ffb2
commit e2f0c49ffa
1 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hw/scsi-disk.c
View File

@ -391,9 +391,6 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
} }
l = strlen(s->serial); l = strlen(s->serial);
if (l > req->cmd.xfer) {
l = req->cmd.xfer;
}
if (l > 20) { if (l > 20) {
l = 20; l = 20;
} }
@ -1002,9 +999,6 @@ static int scsi_disk_emulate_mode_sense(SCSIDiskReq *r, uint8_t *outbuf)
outbuf[0] = ((buflen - 2) >> 8) & 0xff; outbuf[0] = ((buflen - 2) >> 8) & 0xff;
outbuf[1] = (buflen - 2) & 0xff; outbuf[1] = (buflen - 2) & 0xff;
} }
if (buflen > r->req.cmd.xfer) {
buflen = r->req.cmd.xfer;
}
return buflen; return buflen;
} }
@ -1038,9 +1032,6 @@ static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)
default: default:
return -1; return -1;
} }
if (toclen > req->cmd.xfer) {
toclen = req->cmd.xfer;
}
return toclen; return toclen;
} }
@ -1251,6 +1242,7 @@ static int scsi_disk_emulate_command(SCSIDiskReq *r)
scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE)); scsi_check_condition(r, SENSE_CODE(INVALID_OPCODE));
return -1; return -1;
} }
buflen = MIN(buflen, req->cmd.xfer);
return buflen; return buflen;
not_ready: not_ready: