qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buf


From: Alexander Graf
Subject: Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buffer size
Date: Wed, 25 May 2016 14:30:13 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0

On 05/25/2016 02:15 PM, P J P wrote:
+-- On Wed, 25 May 2016, Alexander Graf wrote --+
| >    
http://git.qemu.org/?p=qemu.git;a=blob;f=hw/scsi/megasas.c;h=a63a581550a328d0326ddee4f7fe1c4ffdecc194;hb=HEAD#l1439
| > 'dcmd_size' is same as that of 'info' object.
|
| Ok, then this patch is definitely bogus. The guest may receive less than the
| size of the info object. So we really want to have a MIN() between the maximum
| allowed transfer size (sizeof(info)) and the requested size (cmd->iov_size)
| here.

There is also a check which returns an invalid parameter error if
'cmd->iov_size' is less than 'dcmd_size'. Ie. OOB access occurs when
cmd->iov_size is greater than 'dcmd_size'.

Turns out you're much better at reading code than me - yes, true, all is good :)

Reviewed-by: Alexander Graf <address@hidden>

Alex



reply via email to

[Prev in Thread] Current Thread [Next in Thread]