diff options
| author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2021-11-19 21:11:40 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-12-18 10:57:36 +0100 |
| commit | 97a2b074d150918a7a3a4065b946a52d4d0be8a3 (patch) | |
| tree | 96812c5ed7e76feb30a18218250ef3bd3e6536ea /hw/scsi | |
| parent | 7a3ce79c062117501e89a10a7768051b8b52d562 (diff) | |
| download | qemu-97a2b074d150918a7a3a4065b946a52d4d0be8a3.zip qemu-97a2b074d150918a7a3a4065b946a52d4d0be8a3.tar.gz qemu-97a2b074d150918a7a3a4065b946a52d4d0be8a3.tar.bz2 | |
hw/scsi/megasas: Fails command if SGL buffer overflows
If we detect an overflow on the SGL buffer, do not
keep processing the command: discard it. TARGET_FAILURE
sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR).
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20211119201141.532377-2-philmd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi')
| -rw-r--r-- | hw/scsi/megasas.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 4ff5122..8f35784 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -303,6 +303,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl) } if (cmd->iov_size > iov_size) { trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size); + goto unmap; } else if (cmd->iov_size < iov_size) { trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size); } |