From 4524c893498ef2c8d2fa5da69ccefe167011ed3d Mon Sep 17 00:00:00 2001 From: Luo Yifan Date: Thu, 26 Sep 2024 10:52:25 +0800 Subject: [PATCH] hw/scsi/megasas: Fails command if SGL buffer overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cherry picked from commit 97a2b074d150918a7a3a4065b946a52d4d0be8a3 If we detect an overflow on the SGL buffer, do not keep processing the command: discard it. TARGET_FAILURE sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR). Reported-by: Alexander Bulekov Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521 Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Darren Kenny Message-Id: <20211119201141.532377-2-philmd@redhat.com> Signed-off-by: Paolo Bonzini Signed-off-by: Luo Yifan --- hw/scsi/megasas.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 946050bf83..dc9bbdb740 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -310,6 +310,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl) } if (cmd->iov_size > iov_size) { trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size); + goto unmap; } else if (cmd->iov_size < iov_size) { trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size); } -- 2.41.0.windows.1