summary refs log tree commit diff stats
path: root/hw/scsi/mptsas.c
diff options
context:
space:
mode:
authorJohn Millikin <john@john-millikin.com>2022-08-17 14:34:58 +0900
committerPaolo Bonzini <pbonzini@redhat.com>2022-09-01 07:42:37 +0200
commitfe9d8927e265fd723a6dc87cd6d220f4677dbe1f (patch)
tree0e2d306704d29e6a06cc10b7a320afcbb31279a1 /hw/scsi/mptsas.c
parentc6e51f1bb28ed762d2039c063cbb71a8ad29762d (diff)
downloadfocaccia-qemu-fe9d8927e265fd723a6dc87cd6d220f4677dbe1f.tar.gz
focaccia-qemu-fe9d8927e265fd723a6dc87cd6d220f4677dbe1f.zip
scsi: Add buf_len parameter to scsi_req_new()
When a SCSI command is received from the guest, the CDB length implied
by the first byte might exceed the number of bytes the guest sent. In
this case scsi_req_new() will read uninitialized data, causing
unpredictable behavior.

Adds the buf_len parameter to scsi_req_new() and plumbs it through the
call stack.

Signed-off-by: John Millikin <john@john-millikin.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1127
Message-Id: <20220817053458.698416-1-john@john-millikin.com>
[Fill in correct length for adapters other than ESP. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi/mptsas.c')
-rw-r--r--hw/scsi/mptsas.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index 706cf0df3a..a90c2546f1 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -324,7 +324,8 @@ static int mptsas_process_scsi_io_request(MPTSASState *s,
     }
 
     req->sreq = scsi_req_new(sdev, scsi_io->MsgContext,
-                            scsi_io->LUN[1], scsi_io->CDB, req);
+                             scsi_io->LUN[1], scsi_io->CDB,
+                             scsi_io->CDBLength, req);
 
     if (req->sreq->cmd.xfer > scsi_io->DataLength) {
         goto overrun;