From nobody Mon Feb 9 00:02:13 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1604615245; cv=none; d=zohomail.com; s=zohoarc; b=JhFcEE6Zjd2hIc4FmESY3oqH2X5qVI74/miZcH3FJLqM6I2vxEkzeIU2bkVs4r8pl530q12boL6QLLocKM95MDhzCxr77b1gGTCnxYjAqMSz31uwKDB3JK1xtFSpg+CHRtBOx0hXFxJH8y5exH8UCBcxQQoUdGEAl3nDT845AYs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1604615245; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=gH8y7yYhPRs4wKHaeMxKo7Sv6U9hFlnqoTm/mJlEwTk=; b=RuVxPCD0g+O6TYhbNlwdkV67XfpvqDZpn3Rx9BchS4IW5sVaAR9mn1Sl38UvaiqCBrMTuuA2v61E9cEbgtJasX1sCx5DHNAIdaBDZdispEDW/YgJ5yOrgAr/wRa/1Wu6M5ihiL0Vk5liWPOq6ioXraekZfSmOao3ScWJw7cFpzg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1604615245476805.5464649343613; Thu, 5 Nov 2020 14:27:25 -0800 (PST) Received: from localhost ([::1]:38420 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kanj2-0007NP-Aj for importer@patchew.org; Thu, 05 Nov 2020 17:27:24 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:39930) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kanbR-00079G-2x for qemu-devel@nongnu.org; Thu, 05 Nov 2020 17:19:33 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:64470) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kanbP-000414-9V for qemu-devel@nongnu.org; Thu, 05 Nov 2020 17:19:32 -0500 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0A5M3jZN062850; Thu, 5 Nov 2020 17:19:25 -0500 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 34mryyss92-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 05 Nov 2020 17:19:25 -0500 Received: from m0098417.ppops.net (m0098417.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0A5M4uil066548; Thu, 5 Nov 2020 17:19:25 -0500 Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com with ESMTP id 34mryyss8e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 05 Nov 2020 17:19:24 -0500 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0A5MJFq6000648; Thu, 5 Nov 2020 22:19:24 GMT Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma03dal.us.ibm.com with ESMTP id 34hs33kcc5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 05 Nov 2020 22:19:24 +0000 Received: from b03ledav003.gho.boulder.ibm.com (b03ledav003.gho.boulder.ibm.com [9.17.130.234]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0A5MJHuf39584086 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 5 Nov 2020 22:19:17 GMT Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CF7B16A057; Thu, 5 Nov 2020 22:19:22 +0000 (GMT) Received: from b03ledav003.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 631CF6A04D; Thu, 5 Nov 2020 22:19:22 +0000 (GMT) Received: from Buonos-Thinkpad-X1.ibm.com (unknown [9.65.222.173]) by b03ledav003.gho.boulder.ibm.com (Postfix) with ESMTP; Thu, 5 Nov 2020 22:19:22 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=gH8y7yYhPRs4wKHaeMxKo7Sv6U9hFlnqoTm/mJlEwTk=; b=gLKhQESPtSp+SStwmdDCxd6R2tDyiMH9xHDQ8h8kovZ903HVi40AG19AH0FbUjwJpMtV k/w9XhnmrfFe0lm+7WJVJ+sDVJvDlkvG9TvPmaGHsYBAEXRhNu1PHXrUsfIVQE5m0xCI ROWrIVL3WeBfAtdpkbXRyEIZVFywXLF54rv8OQFShNpSF7ai3nzz+X7J+irhZLzumlHN LU7fF5S+IXFO1A5HGwqW9DmRymWMMiE8Kb3Pm7znXeDy/lPlC73PXQqZ5lhKBnPUGhjw WzVF4ZiMxHcmOYy7egoLXbG69uu1ymcZ6auTpkWHXoXmmdEmQQbqW98LYDdSUKnhtqjv lw== From: Daniele Buono To: dbuono@linux.vnet.ibm.com, qemu-devel@nongnu.org Subject: [PATCH v3 5/9] scsi: fix overflow in scsi_disk_new_request_dump Date: Thu, 5 Nov 2020 17:19:01 -0500 Message-Id: <20201105221905.1350-6-dbuono@linux.vnet.ibm.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20201105221905.1350-1-dbuono@linux.vnet.ibm.com> References: <20201105221905.1350-1-dbuono@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.312, 18.0.737 definitions=2020-11-05_15:2020-11-05, 2020-11-05 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 mlxlogscore=999 clxscore=1015 priorityscore=1501 bulkscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 spamscore=0 suspectscore=0 mlxscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2011050141 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: none client-ip=148.163.158.5; envelope-from=dbuono@linux.vnet.ibm.com; helo=mx0b-001b2d01.pphosted.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/11/05 17:19:18 X-ACL-Warn: Detected OS = Linux 3.x [generic] [fuzzy] X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fam Zheng , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" scsi_disk_new_request_dump is used to dump the content of a scsi request for tracing. It does that by decoding the command to get the size of the command buffer, and then printing the content of such buffer on a string. When using gcc with link-time optimizations, it warns that the argument of malloc may be too large. In function 'scsi_disk_new_request_dump', inlined from 'scsi_new_request' at ../qemu-cfi-v3/hw/scsi/scsi-disk.c:2= 588:9: ../qemu-cfi-v3/hw/scsi/scsi-disk.c:2562:17: warning: argument 1 value '1844= 6744073709551612' exceeds maximum object size 9223372036854775807 [-Walloc-= size-larger-than=3D] line_buffer =3D g_malloc(len * 5 + 1); ^ ../qemu-cfi-v3/hw/scsi/scsi-disk.c: In function 'scsi_new_request': /usr/include/glib-2.0/glib/gmem.h:78:10: note: in a call to allocation func= tion 'g_malloc' declared here gpointer g_malloc (gsize n_bytes) G_GNUC_MALLOC G_GNUC_ALLOC_SIZE= (1); len is a signed integer filled up by scsi_cdb_length which can return -1 if it can't decode the command. In this case, g_malloc would probably fail. However, an unknown command here is a possibility, and since this is used f= or tracing, we should try to print the command anyway, for debugging purposes. Since knowing the size of the command in the buffer is impossible (could not decode the command), only print the header by setting len=3D1 if scsi_cdb_l= ength returned -1 Signed-off-by: Daniele Buono --- If we had a way to know the (maximum) size of the buffer, we could alternatively dump the whole buffer, instead of dumping only the first byte. Not sure if this can be done, nor if it is considered a better option. We could also produce an error instead/in addition to just dumping the buffer, if the command cannot be decoded. hw/scsi/scsi-disk.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index e859534eaf..d70dfdd9dc 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -2559,6 +2559,10 @@ static void scsi_disk_new_request_dump(uint32_t lun,= uint32_t tag, uint8_t *buf) int len =3D scsi_cdb_length(buf); char *line_buffer, *p; =20 + if (len < 0) { + len =3D 1; + } + line_buffer =3D g_malloc(len * 5 + 1); =20 for (i =3D 0, p =3D line_buffer; i < len; i++) { --=20 2.17.1