fix signed/unsigned overflows in SCSI disk (Rik van Riel)
Sector numbers can overflow on a virtual scsi disk of over 1TB in size. Qemu's bdrv_read expects an int64_t, so fix the overflow by going to that data type. On large disks, we clip the capacity to 2TB instead of returning "capacity modulo 2TB". Turn sector_count into an unsigned to prevent a signed/unsigned overflow with SCSI transfers larger than 2TB. We're unlikely to ever hit this bug, but fixing it is just one line. Signed-off-by: Rik van Riel <riel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6467 c046a42c-6fe2-441c-8c8c-71466251a162
This commit is contained in:
parent
baa8c60229
commit
e035b43d7c
|
@ -47,11 +47,11 @@ do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)
|
||||||
typedef struct SCSIRequest {
|
typedef struct SCSIRequest {
|
||||||
SCSIDeviceState *dev;
|
SCSIDeviceState *dev;
|
||||||
uint32_t tag;
|
uint32_t tag;
|
||||||
/* ??? We should probably keep track of whether the data trasfer is
|
/* ??? We should probably keep track of whether the data transfer is
|
||||||
a read or a write. Currently we rely on the host getting it right. */
|
a read or a write. Currently we rely on the host getting it right. */
|
||||||
/* Both sector and sector_count are in terms of qemu 512 byte blocks. */
|
/* Both sector and sector_count are in terms of qemu 512 byte blocks. */
|
||||||
int sector;
|
uint64_t sector;
|
||||||
int sector_count;
|
uint32_t sector_count;
|
||||||
/* The amounnt of data in the buffer. */
|
/* The amounnt of data in the buffer. */
|
||||||
int buf_len;
|
int buf_len;
|
||||||
uint8_t *dma_buf;
|
uint8_t *dma_buf;
|
||||||
|
@ -731,6 +731,9 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
|
||||||
/* Returned value is the address of the last sector. */
|
/* Returned value is the address of the last sector. */
|
||||||
if (nb_sectors) {
|
if (nb_sectors) {
|
||||||
nb_sectors--;
|
nb_sectors--;
|
||||||
|
/* Clip to 2TB, instead of returning capacity modulo 2TB. */
|
||||||
|
if (nb_sectors > UINT32_MAX)
|
||||||
|
nb_sectors = UINT32_MAX;
|
||||||
outbuf[0] = (nb_sectors >> 24) & 0xff;
|
outbuf[0] = (nb_sectors >> 24) & 0xff;
|
||||||
outbuf[1] = (nb_sectors >> 16) & 0xff;
|
outbuf[1] = (nb_sectors >> 16) & 0xff;
|
||||||
outbuf[2] = (nb_sectors >> 8) & 0xff;
|
outbuf[2] = (nb_sectors >> 8) & 0xff;
|
||||||
|
|
Loading…
Reference in New Issue