[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-trivial] [PATCH] scsi: restrict buffer length to req->cmd.xfer
Re: [Qemu-trivial] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands.
Mon, 23 Jan 2012 13:14:26 -0500
On Mon, Jan 23, 2012 at 12:47:54PM -0500, Paolo Bonzini wrote:
> On 01/23/2012 06:15 PM, Thomas Higdon wrote:
> > This prevents the emulated SCSI device from trying to DMA more bytes to the
> > initiator than are expected. Without this, the SCRIPTS code in the emulated
> > LSI
> > device eventually raises a DMA interrupt for a data overrun when an INQUIRY
> > command whose buflen exceeds req->cmd.xfer is processed. It's the
> > responsibility of the client to provide a request buffer and allocation
> > length that are large enough for the result of the command.
> > I'm no expert on SCSI (or qemu), but this appears to be more correct
> > behavior
> > than before, and makes my SCSI INQUIRY commands more successful.
> Yes, this is correct. SCSI says "The device server shall terminate
> transfers to the Data-In Buffer when the number of bytes or blocks
> specified by the ALLOCATION LENGTH field have been transferred or when
> all available data have been transferred, whichever is less".
> The same is already done for example for MODE SENSE commands.
> Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c?
You're talking about the scsi_target_emulate_report_luns() and
scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of
the code, these appear safe. In both functions, I see len getting set
via calls to MIN with r->req->cmd.xfer as one of the arguments. If
you're referring to something else, can you be more specific?