[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [6467] fix signed/unsigned overflows in SCSI disk (Rik van
From: |
Anthony Liguori |
Subject: |
[Qemu-devel] [6467] fix signed/unsigned overflows in SCSI disk (Rik van Riel) |
Date: |
Wed, 28 Jan 2009 21:58:22 +0000 |
Revision: 6467
http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6467
Author: aliguori
Date: 2009-01-28 21:58:22 +0000 (Wed, 28 Jan 2009)
Log Message:
-----------
fix signed/unsigned overflows in SCSI disk (Rik van Riel)
Sector numbers can overflow on a virtual scsi disk of over 1TB
in size. Qemu's bdrv_read expects an int64_t, so fix the overflow
by going to that data type.
On large disks, we clip the capacity to 2TB instead of returning
"capacity modulo 2TB".
Turn sector_count into an unsigned to prevent a signed/unsigned
overflow with SCSI transfers larger than 2TB. We're unlikely to
ever hit this bug, but fixing it is just one line.
Signed-off-by: Rik van Riel <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
Modified Paths:
--------------
trunk/hw/scsi-disk.c
Modified: trunk/hw/scsi-disk.c
===================================================================
--- trunk/hw/scsi-disk.c 2009-01-28 17:16:56 UTC (rev 6466)
+++ trunk/hw/scsi-disk.c 2009-01-28 21:58:22 UTC (rev 6467)
@@ -47,11 +47,11 @@
typedef struct SCSIRequest {
SCSIDeviceState *dev;
uint32_t tag;
- /* ??? We should probably keep track of whether the data trasfer is
+ /* ??? We should probably keep track of whether the data transfer is
a read or a write. Currently we rely on the host getting it right. */
/* Both sector and sector_count are in terms of qemu 512 byte blocks. */
- int sector;
- int sector_count;
+ uint64_t sector;
+ uint32_t sector_count;
/* The amounnt of data in the buffer. */
int buf_len;
uint8_t *dma_buf;
@@ -731,6 +731,9 @@
/* Returned value is the address of the last sector. */
if (nb_sectors) {
nb_sectors--;
+ /* Clip to 2TB, instead of returning capacity modulo 2TB. */
+ if (nb_sectors > UINT32_MAX)
+ nb_sectors = UINT32_MAX;
outbuf[0] = (nb_sectors >> 24) & 0xff;
outbuf[1] = (nb_sectors >> 16) & 0xff;
outbuf[2] = (nb_sectors >> 8) & 0xff;
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [6467] fix signed/unsigned overflows in SCSI disk (Rik van Riel),
Anthony Liguori <=