gwj / at91sam9263 · Commits

Commit e035b43d7c98b1509420d41b017abcdac0de0442

Authored by aliguori
1 parent baa8c602

fix signed/unsigned overflows in SCSI disk (Rik van Riel) 

Sector numbers can overflow on a virtual scsi disk of over 1TB
in size.  Qemu's bdrv_read expects an int64_t, so fix the overflow
by going to that data type.

On large disks, we clip the capacity to 2TB instead of returning
"capacity modulo 2TB".

Turn sector_count into an unsigned to prevent a signed/unsigned
overflow with SCSI transfers larger than 2TB.  We're unlikely to
ever hit this bug, but fixing it is just one line.

Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6467 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 6 additions and 3 deletions
hw/scsi-disk.c
  View file @e035b43
@@ -47,11 +47,11 @@ do { fprintf(stderr, &quot;scsi-disk: &quot; fmt , ##args); } while (0) @@ -47,11 +47,11 @@ do { fprintf(stderr, &quot;scsi-disk: &quot; fmt , ##args); } while (0)
47 typedef struct SCSIRequest { 47 typedef struct SCSIRequest {
48 SCSIDeviceState *dev; 48 SCSIDeviceState *dev;
49 uint32_t tag; 49 uint32_t tag;
50 - /* ??? We should probably keep track of whether the data trasfer is 50 + /* ??? We should probably keep track of whether the data transfer is
51 a read or a write. Currently we rely on the host getting it right. */ 51 a read or a write. Currently we rely on the host getting it right. */
52 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ 52 /* Both sector and sector_count are in terms of qemu 512 byte blocks. */
53 - int sector;  
54 - int sector_count; 53 + uint64_t sector;
  54 + uint32_t sector_count;
55 /* The amounnt of data in the buffer. */ 55 /* The amounnt of data in the buffer. */
56 int buf_len; 56 int buf_len;
57 uint8_t *dma_buf; 57 uint8_t *dma_buf;
@@ -731,6 +731,9 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag, @@ -731,6 +731,9 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
731 /* Returned value is the address of the last sector. */ 731 /* Returned value is the address of the last sector. */
732 if (nb_sectors) { 732 if (nb_sectors) {
733 nb_sectors--; 733 nb_sectors--;
  734 + /* Clip to 2TB, instead of returning capacity modulo 2TB. */
  735 + if (nb_sectors > UINT32_MAX)
  736 + nb_sectors = UINT32_MAX;
734 outbuf[0] = (nb_sectors >> 24) & 0xff; 737 outbuf[0] = (nb_sectors >> 24) & 0xff;
735 outbuf[1] = (nb_sectors >> 16) & 0xff; 738 outbuf[1] = (nb_sectors >> 16) & 0xff;
736 outbuf[2] = (nb_sectors >> 8) & 0xff; 739 outbuf[2] = (nb_sectors >> 8) & 0xff;