From nobody Thu May 2 05:39:29 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=yandex-team.ru Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 152905397600057.509986663441055; Fri, 15 Jun 2018 02:12:56 -0700 (PDT) Received: from localhost ([::1]:45326 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTkml-0003L4-Kq for importer@patchew.org; Fri, 15 Jun 2018 05:12:47 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43277) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTkly-000320-MN for qemu-devel@nongnu.org; Fri, 15 Jun 2018 05:11:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTklt-0002X7-Se for qemu-devel@nongnu.org; Fri, 15 Jun 2018 05:11:58 -0400 Received: from forwardcorp1o.cmail.yandex.net ([37.9.109.47]:35800) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTklt-0002US-FG for qemu-devel@nongnu.org; Fri, 15 Jun 2018 05:11:53 -0400 Received: from smtpcorp1p.mail.yandex.net (smtpcorp1p.mail.yandex.net [IPv6:2a02:6b8:0:1472:2741:0:8b6:10]) by forwardcorp1o.cmail.yandex.net (Yandex) with ESMTP id EDB0A21697; Fri, 15 Jun 2018 12:11:49 +0300 (MSK) Received: from smtpcorp1p.mail.yandex.net (localhost.localdomain [127.0.0.1]) by smtpcorp1p.mail.yandex.net (Yandex) with ESMTP id E62B36E40BEF; Fri, 15 Jun 2018 12:11:49 +0300 (MSK) Received: from unknown (unknown [2a02:6b8:0:40c:44f:e5a2:2148:4fca]) by smtpcorp1p.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id gRWF2KuoHj-BnOq4NHE; Fri, 15 Jun 2018 12:11:49 +0300 (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (Client certificate not present) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1529053909; bh=f73HOcYXbhAeUJCdl89uo3NCwy9r1zCpJ2NRGbzB3Zw=; h=From:To:Cc:Subject:Date:Message-Id; b=kmseSZD/1E79iZtgcF5y28tTNaNDG3c9xSeNRLE0jUBK1TF2Z7vYy9Z4WVMTdE/7+ hgdx1wlYtbw4AB/CCSmqfE1MmDDQux0I9QT6IokCNKDHzvw8l8rXVcpxsFqzY6uvNB X3GOpds767gJPg2v1BGcRgCqUhs4p0M0LRNPyKTc= Authentication-Results: smtpcorp1p.mail.yandex.net; dkim=pass header.i=@yandex-team.ru From: Dima Stepanov To: qemu-devel@nongnu.org Date: Fri, 15 Jun 2018 12:11:44 +0300 Message-Id: <1529053904-12607-1-git-send-email-dimastep@yandex-team.ru> X-Mailer: git-send-email 2.7.4 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 37.9.109.47 Subject: [Qemu-devel] [PATCH v1] qemu-pr-helper: garbage response structure can be used to write data X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: wrfsh@yandex-team.ru Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The prh_co_entry() routine handles requests. The first part is to read a request by calling the prh_read_request() routine, if: 1. scsi_cdb_xfer(req->cdb) call returns 0, and 2. req->cdb[0] =3D=3D PERSISTENT_RESERVE_IN, then The resp->result field will be uninitialized. As a result the resp.sz field will be also uninitialized in the prh_co_entry() function. The second part is to send the response by calling the prh_write_response() routine: 1. For the PERSISTENT_RESERVE_IN command, and 2. resp->result =3D=3D GOOD (previous successful reply or just luck), then There is a probability that the following assert will not be trigered: assert(resp->sz <=3D req->sz && resp->sz <=3D sizeof(client->data)); As a result some uninitialized response will be sent. The fix is to initialize the response structure to CHECK_CONDITION and 0 values before calling the prh_read_request() routine. Signed-off-by: Dima Stepanov --- scsi/qemu-pr-helper.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scsi/qemu-pr-helper.c b/scsi/qemu-pr-helper.c index d0f8317..85878c2 100644 --- a/scsi/qemu-pr-helper.c +++ b/scsi/qemu-pr-helper.c @@ -768,6 +768,8 @@ static void coroutine_fn prh_co_entry(void *opaque) PRHelperResponse resp; int sz; =20 + resp.result =3D CHECK_CONDITION; + resp.sz =3D 0; sz =3D prh_read_request(client, &req, &resp, &local_err); if (sz < 0) { break; --=20 2.7.4