Re: [Qemu-devel] [PATCH] scsi-disk: fix crash on VERIFY command

[Paolo Bonzini]

On 03/01/2017 09:12, Zhang Qian wrote:
> yes, you are right.
> The scenarios of problem is
> a scsi-disk object receives VERIFY command with BYTCHK bit being zero,
> scsi_block_is_passthrough returns false and finally scsi-block uses
> scsi_disk_dma_command for
> VERIFY. So the mode is set to SCSI_XFER_NONE.
> In scsi_req_continue, scsi_read_data function is called.

Uhm, is the fix simply

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index bdd1e5f..c080888 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -2701,7 +2701,7 @@ static bool scsi_block_is_passthrough(SCSIDiskState *s, 
uint8_t *buf)
          * for the number of logical blocks specified in the length
          * field).  For other modes, do not use scatter/gather operation.
          */
-        if ((buf[1] & 6) != 2) {
+        if ((buf[1] & 6) == 2) {
             return false;
         }
         break;

then?

Thanks,

Paolo