scsi: handle the special parameters

[Qemu-devel] [PATCH] scsi: handle the special parameters

linzhecheng posted 1 patch 6 years, 3 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20180115041648.33740-1-linzhecheng@huawei.com

Test checkpatch passed

Test docker passed

Test ppc passed

Test s390x passed

scsi/utils.c | 4 ++++
1 file changed, 4 insertions(+)

Expand all Fold all

[Qemu-devel] [PATCH] scsi: handle the special parameters

Posted by linzhecheng 6 years, 3 months ago

scsi_disk_emulate_command calls
scsi_build_sense(NULL, 0, outbuf, r->buflen,
                                  (req->cmd.buf[1] & 1) == 0);
But scsi_convert_sense doesn't handle the case when in_buf is NULL
or in_len is 0, which will lead to segfault.

Signed-off-by: linzhecheng <linzhecheng@huawei.com>
---
 scsi/utils.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scsi/utils.c b/scsi/utils.c
index ddae650a99..b769e80c12 100644
--- a/scsi/utils.c
+++ b/scsi/utils.c
@@ -322,6 +322,10 @@ int scsi_convert_sense(uint8_t *in_buf, int in_len,
     SCSISense sense;
     bool fixed_in;
 
+    if (!in_buf || !in_len) {
+        return 0;
+    }
+
     fixed_in = (in_buf[0] & 2) == 0;
     if (in_len && fixed == fixed_in) {
         memcpy(buf, in_buf, MIN(len, in_len));
-- 
2.12.2.windows.2

Re: [Qemu-devel] [PATCH] scsi: handle the special parameters

Posted by Paolo Bonzini 6 years, 3 months ago

On 15/01/2018 05:16, linzhecheng wrote:
> scsi_disk_emulate_command calls
> scsi_build_sense(NULL, 0, outbuf, r->buflen,
>                                   (req->cmd.buf[1] & 1) == 0);
> But scsi_convert_sense doesn't handle the case when in_buf is NULL
> or in_len is 0, which will lead to segfault.
> 

This is already fixed in my last pull request.

Paolo

> Signed-off-by: linzhecheng <linzhecheng@huawei.com>
> ---
>  scsi/utils.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/scsi/utils.c b/scsi/utils.c
> index ddae650a99..b769e80c12 100644
> --- a/scsi/utils.c
> +++ b/scsi/utils.c
> @@ -322,6 +322,10 @@ int scsi_convert_sense(uint8_t *in_buf, int in_len,
>      SCSISense sense;
>      bool fixed_in;
>  
> +    if (!in_buf || !in_len) {
> +        return 0;
> +    }
> +
>      fixed_in = (in_buf[0] & 2) == 0;
>      if (in_len && fixed == fixed_in) {
>          memcpy(buf, in_buf, MIN(len, in_len));
>