11aadaf893
- python/aqmp: use absolute import statement - sysemu: Cleanup qemu_run_machine_init_done_notifiers() - vhost-backend: avoid overflow on memslots_limit - hw/i386/vmmouse: Require 'i8042' property to be set - hw/scsi/megasas: Fails command if SGL buffer overflows - target/i386/kvm: Replace use of __u32 type - hw/avr: Realize AVRCPU qdev object using qdev_realize() - qemu-keymap: Add license in generated files - configure: Symlink binaries using .exe suffix with MinGW - ui: remove break after g_assert_not_reached() - io/channel-websock: Replace strlen(const_str) by sizeof(const_str) - 1 - target/ppc: Add HASHKEYR and HASHPKEYR SPRs - tests: Fix error strings - Hexagon (target/hexagon) remove unused encodings - target/i386: introduce insn_get_addr - target/i386: REPZ and REPNZ are mutually exclusive - target/i386: correctly mask SSE4a bit indices in register operands - bios-tables-test: Make oem-fields tests be consistent - tests/vm: update NetBSD to 9.3 - monitor/hmp-cmds: Avoid displaying bogus size in 'info pci' When BAR aren't mapped, we get: - virtio-mem: don't warn about THP sizes on a kernel without THP Support - Subject: [PATCH] kvm: Use 'unsigned long' for request argument in functions wrapping ioctl() Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 2430c96ac522f910c11eb98c2d9f74c2c3336a00)
41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
From 4524c893498ef2c8d2fa5da69ccefe167011ed3d Mon Sep 17 00:00:00 2001
|
|
From: Luo Yifan <luoyifan_yewu@cmss.chinamobile.com>
|
|
Date: Thu, 26 Sep 2024 10:52:25 +0800
|
|
Subject: [PATCH] hw/scsi/megasas: Fails command if SGL buffer overflows
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
cherry picked from commit 97a2b074d150918a7a3a4065b946a52d4d0be8a3
|
|
|
|
If we detect an overflow on the SGL buffer, do not
|
|
keep processing the command: discard it. TARGET_FAILURE
|
|
sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR).
|
|
|
|
Reported-by: Alexander Bulekov <alxndr@bu.edu>
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
|
|
Message-Id: <20211119201141.532377-2-philmd@redhat.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Signed-off-by: Luo Yifan <luoyifan_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/scsi/megasas.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
|
|
index 946050bf83..dc9bbdb740 100644
|
|
--- a/hw/scsi/megasas.c
|
|
+++ b/hw/scsi/megasas.c
|
|
@@ -310,6 +310,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
|
|
}
|
|
if (cmd->iov_size > iov_size) {
|
|
trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
|
|
+ goto unmap;
|
|
} else if (cmd->iov_size < iov_size) {
|
|
trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
|
|
}
|
|
--
|
|
2.41.0.windows.1
|
|
|