A guest with an attached scsi-hd can force QEMU's SCSI disk emulation
to read roughly 60 KiB past the end of a heap buffer, copying that out
of bounds host memory into the guest's own disk image.

This is due to a race between WRITE SAME and an obscure MODE SELECT
feature which can be restricted to the Q800 machine.

Paolo

Paolo Bonzini (2):
  scsi-disk: fix out-of-bound read in WRITE SAME
  scsi: hide MODE SELECT block size change behind a quirk

 include/hw/scsi/scsi.h |  1 +
 hw/m68k/q800.c         |  2 ++
 hw/scsi/scsi-disk.c    | 17 +++++++++++++----
 3 files changed, 16 insertions(+), 4 deletions(-)

-- 
2.55.0

On Wed, Aug 26, 2026 at 08:17:23PM +0200, Paolo Bonzini wrote:
> A guest with an attached scsi-hd can force QEMU's SCSI disk emulation
> to read roughly 60 KiB past the end of a heap buffer, copying that out
> of bounds host memory into the guest's own disk image.
> 
> This is due to a race between WRITE SAME and an obscure MODE SELECT
> feature which can be restricted to the Q800 machine.
> 
> Paolo
> 
> Paolo Bonzini (2):
>   scsi-disk: fix out-of-bound read in WRITE SAME
>   scsi: hide MODE SELECT block size change behind a quirk
> 
>  include/hw/scsi/scsi.h |  1 +
>  hw/m68k/q800.c         |  2 ++
>  hw/scsi/scsi-disk.c    | 17 +++++++++++++----
>  3 files changed, 16 insertions(+), 4 deletions(-)
> 
> -- 
> 2.55.0
> 
> 

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>