41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
|
From 4524c893498ef2c8d2fa5da69ccefe167011ed3d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Luo Yifan <luoyifan_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Thu, 26 Sep 2024 10:52:25 +0800
|
||
|
|
Subject: [PATCH] hw/scsi/megasas: Fails command if SGL buffer overflows
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
cherry picked from commit 97a2b074d150918a7a3a4065b946a52d4d0be8a3
|
||
|
|
|
||
|
|
If we detect an overflow on the SGL buffer, do not
|
||
|
|
keep processing the command: discard it. TARGET_FAILURE
|
||
|
|
sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR).
|
||
|
|
|
||
|
|
Reported-by: Alexander Bulekov <alxndr@bu.edu>
|
||
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521
|
||
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
||
|
|
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
|
||
|
|
Message-Id: <20211119201141.532377-2-philmd@redhat.com>
|
||
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||
|
|
Signed-off-by: Luo Yifan <luoyifan_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/scsi/megasas.c | 1 +
|
||
|
|
1 file changed, 1 insertion(+)
|
||
|
|
|
||
|
|
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
|
||
|
|
index 946050bf83..dc9bbdb740 100644
|
||
|
|
--- a/hw/scsi/megasas.c
|
||
|
|
+++ b/hw/scsi/megasas.c
|
||
|
|
@@ -310,6 +310,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
|
||
|
|
}
|
||
|
|
if (cmd->iov_size > iov_size) {
|
||
|
|
trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
|
||
|
|
+ goto unmap;
|
||
|
|
} else if (cmd->iov_size < iov_size) {
|
||
|
|
trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|