[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] scsi: initialise info object with appropriate s
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH] scsi: initialise info object with appropriate size |
Date: |
Mon, 21 Dec 2015 16:29:22 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 |
On 21/12/2015 10:43, P J P wrote:
> Hello,
>
> A stack overflow issue was reported by Mr Qinghao Tang, CC'd here. It
> occurs while processing the SCSI controller's CTRL_GET_INFO command, as
> the memset(2) call uses driver supplied 'cmd->iov_size' to initialise
> the '&info' object.
>
> Please see below a proposed patch to fix this issue. Does it look okay?
>
> ===
> From 5823b4a214ede884f4ba597fdd629862620e0f92 Mon Sep 17 00:00:00 2001
> From: Prasad J Pandit <address@hidden>
> Date: Mon, 21 Dec 2015 14:48:18 +0530
> Subject: [PATCH] scsi: initialise info object with appropriate size
>
> While processing controller 'CTRL_GET_INFO' command, the routine
> 'megasas_ctrl_get_info' overflows the '&info' object size. Use its
> appropriate size to null initialise it.
>
> Reported-by: Qinghao Tang <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
> hw/scsi/megasas.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> index d7dc667..576f56c 100644
> --- a/hw/scsi/megasas.c
> +++ b/hw/scsi/megasas.c
> @@ -718,7 +718,7 @@ static int megasas_ctrl_get_info(MegasasState *s,
> MegasasCmd *cmd)
> BusChild *kid;
> int num_pd_disks = 0;
>
> - memset(&info, 0x0, cmd->iov_size);
> + memset(&info, 0x0, dcmd_size);
> if (cmd->iov_size < dcmd_size) {
> trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
> dcmd_size);
Yes, it is. I've queued this patch to my for-2.6 branch.
Paolo