[v2] hw/scsi/megasas: Avoid buffer overrun in megasas_handle_scsi()

[PATCH v2 0/4] hw/scsi/megasas: Avoid buffer overrun in megasas_handle_scsi()

Philippe Mathieu-Daudé posted 4 patches 4 years, 11 months ago

Diff against v1
Download series mbox

Test checkpatch passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20201201191026.4149955-1-philmd@redhat.com

hw/scsi/megasas.c       | 13 +++++++++++++
tests/qtest/fuzz-test.c | 20 ++++++++++++++++++++
2 files changed, 33 insertions(+)

Expand all Fold all

[PATCH v2 0/4] hw/scsi/megasas: Avoid buffer overrun in megasas_handle_scsi()

Posted by Philippe Mathieu-Daudé 4 years, 11 months ago

FWIW megasas is not use by KVM.

Not sure what is the proper fix, but at least we
have a reproducer.

Since v1:
- Fix assert() condition
- Extract reproducer in different patch for git-bisect (thuth)
- Add simpler reproducer from Alex
- Try better scsi error

Philippe Mathieu-Daudé (4):
  tests/qtest/fuzz-test: Quit test_lp1878642 once done
  hw/scsi/megasas: Assert cdb_len is valid in megasas_handle_scsi()
  tests/qtest/fuzz-test: Add test_megasas_cdb_len_zero() reproducer
  hw/scsi/megasas: Have incorrect cdb return MFI_STAT_ABORT_NOT_POSSIBLE

 hw/scsi/megasas.c       | 13 +++++++++++++
 tests/qtest/fuzz-test.c | 20 ++++++++++++++++++++
 2 files changed, 33 insertions(+)

-- 
2.26.2